--- analysis: Single rules may fire on the use of PKINIT, but this hunt links that authentication event back to a specific discovery phase on a workstation and forward to exfiltration impact, providing the context required to distinguish it from legitimate admin tasks. blind_spots: - id: no-ca-audit-logs question: whether the certificate was issued even if it was never installed on a managed endpoint requires: Active Directory Certificate Services audit logs (Event 4886/4887) risk: A certificate issued to a remote tool used by an attacker would only be visible on the CA itself, not in endpoint certificate stores. stage: ad-cs-certificate-abuse - id: ldaps-payload-encryption question: what specific template information was queried during discovery requires: LDAPS decryption or LDAP signing logs risk: We can see the connection to the DC, but not the specific LDAP filters used to find ESC1 templates. stage: ad-cs-assessment coverage: - stage: ad-cs-assessment status: covered steps: - identify-ad-cs-discovery - stage: ad-cs-certificate-abuse status: covered steps: - new-privileged-certs - pkinit-kerberos-auth - stage: data-exfiltration status: covered steps: - large-outbound-transfers - reason: 'Belongs to another part of the ''From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths'' series.' stage: teams-impersonation-phishing status: out_of_scope - reason: 'Belongs to another part of the ''From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths'' series.' stage: remote-access-quick-assist status: out_of_scope - reason: 'Belongs to another part of the ''From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths'' series.' stage: portable-runtime-staging status: out_of_scope - reason: 'Belongs to another part of the ''From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths'' series.' stage: host-discovery status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: AD CS abuse provides a durable authentication path that survives password resets and host reimaging; this hunt ensures that escalation from a user foothold to domain infrastructure is detected at the transition point. methodology: model-assisted trigger: intel-report hypothesis: An adversary is performing discovery against Active Directory Certificate Services to identify vulnerable templates (ESC1) or coercive authentication targets (ESC8), then obtaining certificates for privileged accounts to facilitate Kerberos authentication and data exfiltration. labels: - hunt - attack.t1016 - attack.t1041 - attack.t1082 - attack.t1557 - attack.t1567.002 - attack.t1649 - credential access - discovery - execution - exfiltration - initial access name: AD CS Certificate Abuse and Lateral Movement parameters: domain_controller_ips: default: [] description: Known Domain Controller IPs to narrow the search for discovery traffic. from: kind: article observed: '2026-10-30' ref: https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ type: list[ip] exfil_threshold_bytes: default: '100000000' description: Outbound data threshold in bytes (default 100MB) for exfiltration triage. type: number lookback_days: default: '14' description: Days of history to examine. from: kind: article observed: '2026-10-30' ref: msrc-blog type: number scope_hosts: default: [] description: Hosts identified as beachheads to filter later parallel queries. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus discovery queries on non-Domain Controller workstations. If the network logs are noisy, filter for connections originating from user-profile staging directories found in the portable runtime hunt. references: - name: 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' url: https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ related: - hunt: portable-runtime-execution-staging reason: Execution of the runtimes (Python/Bun) that perform the initial discovery is a preceding stage handled separately. relation: out-of-scope-alternative - hunt: teams-impersonation-portable-runtime-execution relation: follows scenario: stages: - name: Teams Helpdesk Impersonation observables: - onmicrosoft.com tenant names - support-oriented display names - Microsoft Teams messages and calls slug: teams-impersonation-phishing tactic: initial-access techniques: - T1566.003 - T1566.004 - name: Remote Support Hijack observables: - QuickAssist.exe - user-approved remote session slug: remote-access-quick-assist tactic: execution techniques: - T1219 - name: Portable Runtime Staging observables: - KB-prefixed directory in user profile - archive in Downloads folder - renamed Bun executable - portable Python runtime - portable Java runtime slug: portable-runtime-staging tactic: execution techniques: - T1036 - T1059.003 - T1059.007 - name: Host and Network Discovery observables: - ipconfig /all - tasklist - Windows version registry query slug: host-discovery tactic: discovery techniques: - T1016 - T1057 - T1082 - name: AD CS Vulnerability Assessment observables: - LDAPS connections to domain infrastructure - SMB connections to domain infrastructure slug: ad-cs-assessment tactic: discovery techniques: - T1082 - name: AD CS Privilege Escalation (ESC1/ESC8) observables: - ESC1 vulnerable template abuse - PetitPotam NTLM relay - Relay to AD CS Web Enrollment (ESC8) - PKINIT certificate-based Kerberos authentication slug: ad-cs-certificate-abuse tactic: credential-access techniques: - T1649 - T1557 - T1190 - name: Privileged Data Exfiltration observables: - Exfiltration via privileged identity excluded from containment slug: data-exfiltration tactic: exfiltration techniques: - T1041 - T1567.002 summary: Threat actors use Microsoft Teams to impersonate help desk staff and persuade users to grant remote access via Quick Assist. From this foothold, they execute scripts via portable runtimes to discover and abuse AD CS configurations, specifically ESC1 and ESC8, to escalate privileges and obtain persistent domain access. series: index: 2 slug: from-help-desk-impersonation-to-ad-cs-abuse-investigating-esc1-and-esc8-intrusion-paths title: 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # AD CS Certificate Abuse and Lateral Movement This hunt identifies the transition from initial host foothold to Active Directory domain escalation through Certificate Services (AD CS). It starts by locating workstation-to-DC connections on LDAPS and SMB ports that suggest template enumeration or authentication coercion. It then fans out to find evidence of new privileged certificates, certificate-backed Kerberos (PKINIT) authentication, and large data transfers linked to the same identities. An agent correlates these results to distinguish administrative activity from a persistent intrusion that bypasses standard password-based controls. ## identify-ad-cs-discovery Identify workstations performing unusual LDAP(S) or SMB connections to domain infrastructure, indicating template assessment or coercion attempts like PetitPotam. ```sqlite target=network role=baseline params=(lookback_days=lookback_days, domain_controller_ips=domain_controller_ips) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A small number of workstations making repetitive LDAPS or SMB calls to DCs. Silence suggests no automated discovery occurred during the window. prevalence: by: device_hostname key: - device_hostname - process_name rare_below: 5 reads: - device_hostname - process_name - dst_endpoint_ip - dst_endpoint_port - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-10-31' ~~~ SELECT device_hostname, LOWER(process_name) AS process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port IN (389, 636, 445, 3269) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{domain_controller_ips}}' = '' OR instr(',' || '{{domain_controller_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) GROUP BY device_hostname, LOWER(process_name), dst_endpoint_ip, dst_endpoint_port ORDER BY connection_count DESC ``` ## corroborate-escalation parallel: - → new-privileged-certs - → pkinit-kerberos-auth - → large-outbound-transfers join: → ad-cs-abuse-triage ## new-privileged-certs Find certificates issued to domain controllers or administrative accounts within the lookback period. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days) ~~~yaml expected: Certificates for machine accounts ($) or administrative users not requested by standard automation. Absence on endpoints does not prove the CA did not issue them. reads: - subject - issuer - common_name - serial_number - not_after - owner - provider - not_before silence: not_evidence_of_absence source: hb_certificates verified: dry-run verified_at: '2026-10-31' ~~~ SELECT subject, issuer, common_name, serial_number, not_after, owner, provider FROM hb_certificates WHERE not_before >= datetime('now', '-{{lookback_days}} days') AND (LOWER(subject) LIKE '%$%' OR LOWER(subject) LIKE '%admin%' OR LOWER(subject) LIKE '%svc%') ORDER BY not_before DESC ``` ## pkinit-kerberos-auth Detect use of certificates for Kerberos authentication, which the adversary uses after obtaining certificates via ESC1 or ESC8. ```sqlite target=identity role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Logon events indicating Kerberos with a certificate thumbprint, especially from identified beachheads. This is the primary indicator of certificate misuse. reads: - actor_user_name - device_hostname - src_endpoint_hostname - src_endpoint_ip - auth_protocol - cert_thumbprint - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-31' ~~~ SELECT actor_user_name, device_hostname, src_endpoint_hostname, src_endpoint_ip, auth_protocol, cert_thumbprint, time FROM hb_auth_signin WHERE (auth_protocol = 'PKINIT' OR (auth_protocol = 'Kerberos' AND cert_thumbprint IS NOT NULL)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || src_endpoint_hostname || ',') > 0) ORDER BY time DESC ``` ## large-outbound-transfers Examine network connections for exfiltration patterns, particularly from accounts or hosts involved in the escalation chain. ```sqlite target=network role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts, exfil_threshold_bytes=exfil_threshold_bytes) ~~~yaml expected: A user account with a newly issued certificate performing high-volume transfers to external IPs. Zero results is evidence of absence for the specific threshold. reads: - device_hostname - user_name - dst_endpoint_ip - traffic_bytes - direction - time silence: evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-10-31' ~~~ SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes, MIN(time) AS start_time FROM hb_network_connection WHERE direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > {{exfil_threshold_bytes}} ORDER BY total_bytes DESC ``` ## ad-cs-abuse-triage ```agent target=hunter cite: required context: - identify-ad-cs-discovery - new-privileged-certs - pkinit-kerberos-auth - large-outbound-transfers max_iterations: 6 objective: Determine whether any host identified in discovery is linked to a new privileged certificate or subsequent PKINIT logons for a different user/machine account. success_criteria: A verdict of malicious | suspicious | benign per host, citing the certificates and logons. tools: - endpoint - identity - network ``` ## route-on-verdict if~: "the triage verdict is malicious for any host or identity" (confidence: high, judge=hunter) then: → isolate-and-revoke indeterminate: → analyst-validation unavailable: → analyst-validation (blind_spot: no-ca-audit-logs) else: → close-out ## isolate-and-revoke ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the compromised host from the network. Revoke every Active Directory certificate issued to the affected machine account or user account identified by the agent triage. ``` → analyst-validation ## analyst-validation ```manual target=analyst Examine the process that initiated the LDAPS/SMB traffic on the beachhead host. Verify if the certificate issuance correlates with a change request or a documented administrative task. ``` → close-out ## close-out ```manual target=analyst Summarize the findings. If no abuse was found, document the hosts that were scoped and the time window covered. ``` → end