{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AD CS abuse provides a durable authentication path that survives password resets and host reimaging; this hunt ensures that escalation from a user foothold to domain infrastructure is detected at the transition point." }, "name": "AD CS Certificate Abuse and Lateral Movement", "type": "investigation", "labels": [ "hunt", "attack.t1016", "attack.t1041", "attack.t1082", "attack.t1557", "attack.t1567.002", "attack.t1649", "credential access", "discovery", "execution", "exfiltration", "initial access" ], "series": { "slug": "from-help-desk-impersonation-to-ad-cs-abuse-investigating-esc1-and-esc8-intrusion-paths", "index": 2, "title": "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths", "total": 2 }, "related": [ { "hunt": "portable-runtime-execution-staging", "reason": "Execution of the runtimes (Python/Bun) that perform the initial discovery is a preceding stage handled separately.", "relation": "out-of-scope-alternative" }, { "hunt": "teams-impersonation-portable-runtime-execution", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "Single rules may fire on the use of PKINIT, but this hunt links that authentication event back to a specific discovery phase on a workstation and forward to exfiltration impact, providing the context required to distinguish it from legitimate admin tasks.", "coverage": [ { "stage": "ad-cs-assessment", "steps": [ "identify-ad-cs-discovery" ], "status": "covered" }, { "stage": "ad-cs-certificate-abuse", "steps": [ "new-privileged-certs", "pkinit-kerberos-auth" ], "status": "covered" }, { "stage": "data-exfiltration", "steps": [ "large-outbound-transfers" ], "status": "covered" }, { "stage": "teams-impersonation-phishing", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "remote-access-quick-assist", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "portable-runtime-staging", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "host-discovery", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Teams Helpdesk Impersonation", "slug": "teams-impersonation-phishing", "tactic": "initial-access", "techniques": [ "T1566.003", "T1566.004" ], "observables": [ "onmicrosoft.com tenant names", "support-oriented display names", "Microsoft Teams messages and calls" ] }, { "name": "Remote Support Hijack", "slug": "remote-access-quick-assist", "tactic": "execution", "techniques": [ "T1219" ], "observables": [ "QuickAssist.exe", "user-approved remote session" ] }, { "name": "Portable Runtime Staging", "slug": "portable-runtime-staging", "tactic": "execution", "techniques": [ "T1036", "T1059.003", "T1059.007" ], "observables": [ "KB-prefixed directory in user profile", "archive in Downloads folder", "renamed Bun executable", "portable Python runtime", "portable Java runtime" ] }, { "name": "Host and Network Discovery", "slug": "host-discovery", "tactic": "discovery", "techniques": [ "T1016", "T1057", "T1082" ], "observables": [ "ipconfig /all", "tasklist", "Windows version registry query" ] }, { "name": "AD CS Vulnerability Assessment", "slug": "ad-cs-assessment", "tactic": "discovery", "techniques": [ "T1082" ], "observables": [ "LDAPS connections to domain infrastructure", "SMB connections to domain infrastructure" ] }, { "name": "AD CS Privilege Escalation (ESC1/ESC8)", "slug": "ad-cs-certificate-abuse", "tactic": "credential-access", "techniques": [ "T1649", "T1557", "T1190" ], "observables": [ "ESC1 vulnerable template abuse", "PetitPotam NTLM relay", "Relay to AD CS Web Enrollment (ESC8)", "PKINIT certificate-based Kerberos authentication" ] }, { "name": "Privileged Data Exfiltration", "slug": "data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041", "T1567.002" ], "observables": [ "Exfiltration via privileged identity excluded from containment" ] } ], "summary": "Threat actors use Microsoft Teams to impersonate help desk staff and persuade users to grant remote access via Quick Assist. From this foothold, they execute scripts via portable runtimes to discover and abuse AD CS configurations, specifically ESC1 and ESC8, to escalate privileges and obtain persistent domain access." }, "severity": "high", "rationale": "Focus discovery queries on non-Domain Controller workstations. If the network logs are noisy, filter for connections originating from user-profile staging directories found in the portable runtime hunt.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is performing discovery against Active Directory Certificate Services to identify vulnerable templates (ESC1) or coercive authentication targets (ESC8), then obtaining certificates for privileged accounts to facilitate Kerberos authentication and data exfiltration.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hosts identified as beachheads to filter later parallel queries." }, "lookback_days": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-10-30" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "domain_controller_ips": { "from": { "ref": "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/", "kind": "article", "observed": "2026-10-30" }, "type": "list[ip]", "default": [], "description": "Known Domain Controller IPs to narrow the search for discovery traffic." }, "exfil_threshold_bytes": { "type": "number", "default": "100000000", "description": "Outbound data threshold in bytes (default 100MB) for exfiltration triage." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/", "name": "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths" } ], "blind_spots": [ { "id": "no-ca-audit-logs", "risk": "A certificate issued to a remote tool used by an attacker would only be visible on the CA itself, not in endpoint certificate stores.", "stage": "ad-cs-certificate-abuse", "question": "whether the certificate was issued even if it was never installed on a managed endpoint", "requires": "Active Directory Certificate Services audit logs (Event 4886/4887)" }, { "id": "ldaps-payload-encryption", "risk": "We can see the connection to the DC, but not the specific LDAP filters used to find ESC1 templates.", "stage": "ad-cs-assessment", "question": "what specific template information was queried during discovery", "requires": "LDAPS decryption or LDAP signing logs" } ] }, "name": "AD CS Certificate Abuse and Lateral Movement", "description": "This hunt identifies the transition from initial host foothold to Active Directory domain escalation through Certificate Services (AD CS). It starts by locating workstation-to-DC connections on LDAPS and SMB ports that suggest template enumeration or authentication coercion. It then fans out to find evidence of new privileged certificates, certificate-backed Kerberos (PKINIT) authentication, and large data transfers linked to the same identities. An agent correlates these results to distinguish administrative activity from a persistent intrusion that bypasses standard password-based controls." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "from-help-desk-impersonation-to-ad-cs-abuse-investigating-esc1-and-esc8-intrusion-paths", "index": 2, "title": "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths", "total": 2 }, "coverage": [ { "stage": "ad-cs-assessment", "steps": [ "identify-ad-cs-discovery" ], "status": "covered" }, { "stage": "ad-cs-certificate-abuse", "steps": [ "new-privileged-certs", "pkinit-kerberos-auth" ], "status": "covered" }, { "stage": "data-exfiltration", "steps": [ "large-outbound-transfers" ], "status": "covered" }, { "stage": "teams-impersonation-phishing", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "remote-access-quick-assist", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "portable-runtime-staging", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "host-discovery", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" } ], "rationale": "An adversary is performing discovery against Active Directory Certificate Services to identify vulnerable templates (ESC1) or coercive authentication targets (ESC8), then obtaining certificates for privileged accounts to facilitate Kerberos authentication and data exfiltration.", "blind_spots": [ { "id": "no-ca-audit-logs", "risk": "A certificate issued to a remote tool used by an attacker would only be visible on the CA itself, not in endpoint certificate stores.", "stage": "ad-cs-certificate-abuse", "question": "whether the certificate was issued even if it was never installed on a managed endpoint", "requires": "Active Directory Certificate Services audit logs (Event 4886/4887)" }, { "id": "ldaps-payload-encryption", "risk": "We can see the connection to the DC, but not the specific LDAP filters used to find ESC1 templates.", "stage": "ad-cs-assessment", "question": "what specific template information was queried during discovery", "requires": "LDAPS decryption or LDAP signing logs" } ], "scoping_notes": "Focus discovery queries on non-Domain Controller workstations. If the network logs are noisy, filter for connections originating from user-profile staging directories found in the portable runtime hunt.", "beyond_detection": "Single rules may fire on the use of PKINIT, but this hunt links that authentication event back to a specific discovery phase on a workstation and forward to exfiltration impact, providing the context required to distinguish it from legitimate admin tasks." } }, { "id": "identify-ad-cs-discovery", "type": "query", "label": "AD CS Discovery via LDAPS and SMB", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, LOWER(process_name) AS process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port IN (389, 636, 445, 3269) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{domain_controller_ips}}' = '' OR instr(',' || '{{domain_controller_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) GROUP BY device_hostname, LOWER(process_name), dst_endpoint_ip, dst_endpoint_port ORDER BY connection_count DESC", "surface": "hb_network_connection", "description": "Identify workstations performing unusual LDAP(S) or SMB connections to domain infrastructure, indicating template assessment or coercion attempts like PetitPotam.", "expected_signal": "A small number of workstations making repetitive LDAPS or SMB calls to DCs. Silence suggests no automated discovery occurred during the window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "AD CS Discovery via LDAPS and SMB", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, LOWER(process_name) AS process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port IN (389, 636, 445, 3269) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{domain_controller_ips}}' = '' OR instr(',' || '{{domain_controller_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) GROUP BY device_hostname, LOWER(process_name), dst_endpoint_ip, dst_endpoint_port ORDER BY connection_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A small number of workstations making repetitive LDAPS or SMB calls to DCs. Silence suggests no automated discovery occurred during the window.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "device_hostname", "process_name" ], "rare_below": 5 }, "verified_at": "2026-10-31" } }, { "id": "new-privileged-certs", "type": "query", "label": "New Privileged Certificates", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT subject, issuer, common_name, serial_number, not_after, owner, provider FROM hb_certificates WHERE not_before >= datetime('now', '-{{lookback_days}} days') AND (LOWER(subject) LIKE '%$%' OR LOWER(subject) LIKE '%admin%' OR LOWER(subject) LIKE '%svc%') ORDER BY not_before DESC", "surface": "hb_certificates", "description": "Find certificates issued to domain controllers or administrative accounts within the lookback period.", "expected_signal": "Certificates for machine accounts ($) or administrative users not requested by standard automation. Absence on endpoints does not prove the CA did not issue them." }, "parents": [ { "id": "identify-ad-cs-discovery" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "New Privileged Certificates", "reads": [ "subject", "issuer", "common_name", "serial_number", "not_after", "owner", "provider", "not_before" ], "source": "hb_certificates", "target": "endpoint", "content": "SELECT subject, issuer, common_name, serial_number, not_after, owner, provider FROM hb_certificates WHERE not_before >= datetime('now', '-{{lookback_days}} days') AND (LOWER(subject) LIKE '%$%' OR LOWER(subject) LIKE '%admin%' OR LOWER(subject) LIKE '%svc%') ORDER BY not_before DESC", "silence": "not_evidence_of_absence", "expected": "Certificates for machine accounts ($) or administrative users not requested by standard automation. Absence on endpoints does not prove the CA did not issue them.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "pkinit-kerberos-auth", "type": "query", "label": "Certificate-Backed Logons (PKINIT)", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "identity", "content": "SELECT actor_user_name, device_hostname, src_endpoint_hostname, src_endpoint_ip, auth_protocol, cert_thumbprint, time FROM hb_auth_signin WHERE (auth_protocol = 'PKINIT' OR (auth_protocol = 'Kerberos' AND cert_thumbprint IS NOT NULL)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || src_endpoint_hostname || ',') > 0) ORDER BY time DESC", "surface": "hb_auth_signin", "description": "Detect use of certificates for Kerberos authentication, which the adversary uses after obtaining certificates via ESC1 or ESC8.", "expected_signal": "Logon events indicating Kerberos with a certificate thumbprint, especially from identified beachheads. This is the primary indicator of certificate misuse." }, "parents": [ { "id": "identify-ad-cs-discovery" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Certificate-Backed Logons (PKINIT)", "reads": [ "actor_user_name", "device_hostname", "src_endpoint_hostname", "src_endpoint_ip", "auth_protocol", "cert_thumbprint", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, device_hostname, src_endpoint_hostname, src_endpoint_ip, auth_protocol, cert_thumbprint, time FROM hb_auth_signin WHERE (auth_protocol = 'PKINIT' OR (auth_protocol = 'Kerberos' AND cert_thumbprint IS NOT NULL)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || src_endpoint_hostname || ',') > 0) ORDER BY time DESC", "silence": "not_evidence_of_absence", "expected": "Logon events indicating Kerberos with a certificate thumbprint, especially from identified beachheads. This is the primary indicator of certificate misuse.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "large-outbound-transfers", "type": "query", "label": "Large Outbound Data Transfers", "config": { "dsl": "sqlite", "role": "triage", "source": "network", "content": "SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes, MIN(time) AS start_time FROM hb_network_connection WHERE direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > {{exfil_threshold_bytes}} ORDER BY total_bytes DESC", "surface": "hb_network_connection", "description": "Examine network connections for exfiltration patterns, particularly from accounts or hosts involved in the escalation chain.", "expected_signal": "A user account with a newly issued certificate performing high-volume transfers to external IPs. Zero results is evidence of absence for the specific threshold." }, "parents": [ { "id": "identify-ad-cs-discovery" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Large Outbound Data Transfers", "reads": [ "device_hostname", "user_name", "dst_endpoint_ip", "traffic_bytes", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes, MIN(time) AS start_time FROM hb_network_connection WHERE direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > {{exfil_threshold_bytes}} ORDER BY total_bytes DESC", "silence": "evidence_of_absence", "expected": "A user account with a newly issued certificate performing high-volume transfers to external IPs. Zero results is evidence of absence for the specific threshold.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "ad-cs-abuse-triage", "type": "analytic", "label": "Triage AD CS Abuse Chain", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network" ], "context": [ "identify-ad-cs-discovery", "new-privileged-certs", "pkinit-kerberos-auth", "large-outbound-transfers" ], "objective": "Determine whether any host identified in discovery is linked to a new privileged certificate or subsequent PKINIT logons for a different user/machine account.", "description": "Correlate discovery activity with certificate issuance and PKINIT logons to determine if a privileged account has been compromised.", "max_iterations": 6, "expected_signal": "A per-host and per-identity verdict citing specific network and auth rows.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing the certificates and logons." }, "parents": [ { "id": "new-privileged-certs", "kind": "merge" }, { "id": "pkinit-kerberos-auth", "kind": "merge" }, { "id": "large-outbound-transfers", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for any host or identity", "condition": "the triage verdict is malicious for any host or identity", "blind_spot": "no-ca-audit-logs", "confidence": "high", "description": "Route to containment if a certificate-based intrusion is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "ad-cs-abuse-triage" } ] }, { "id": "isolate-and-revoke", "type": "action", "label": "Isolate and Revoke", "config": { "target": "endpoint", "description": "Immediately contain the host beachhead and invalidate the issued certificates.", "instructions": "Isolate the compromised host from the network. Revoke every Active Directory certificate issued to the affected machine account or user account identified by the agent triage.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-validation", "type": "task", "label": "Analyst Validation", "config": { "assignee": "analyst", "description": "Review the agent's findings and confirm whether the activity was legitimate administration or an intrusion.", "instructions": "Examine the process that initiated the LDAPS/SMB traffic on the beachhead host. Verify if the certificate issuance correlates with a change request or a documented administrative task." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-and-revoke" } ] }, { "id": "close-out", "type": "task", "label": "Close-out", "config": { "assignee": "analyst", "description": "Record the hunt results and document any gaps in visibility.", "instructions": "Summarize the findings. If no abuse was found, document the hosts that were scoped and the time window covered." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-validation" } ] } ] }