From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Microsoft has detailed an intrusion path that began with Microsoft Teams support impersonation and led to remote access, malicious code execution and abuse of Active Directory Certificate Services through the ESC1 and ESC8 techniques. The activity involved authentication relay and Kerberos abuse.