Feed / Teams
highTeamssecurity advisoryms_security_blog · Oct 30, 2026

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

The article discusses security vulnerabilities in Teams that could allow impersonation and abuse of Certificate Services through authentication relay and Kerberos, highlighting potential risks for organizations using these features.

“Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog.”
View original article →
Identity
authenticationconditional_access
Security
threat_protectionattack_surface_reductionidentity_security
Audience
security_engineeradminidentity_architect
Environment
cloudhybrid
Ontology Topics
AZ-500SC-300
Classification confidence: 90%
Loading correlations…
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths | 365Forge