From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog .
Read at Microsoft Threat Intelligence
- Vendor
- Microsoft
- Product
- Active Directory / Entra ID
- Exposure class
- Identity
Why it ranks 28 (Notable)
- Exposed product class: identity
- Widely deployed vendor product (Microsoft)
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Microsoft Threat Intelligence (microsoft.com)