Help desk impersonation now mints credentials that survive a reset

The call arrives over Teams. The name looks like someone from IT. The person on the other end is patient, helpful, and asks the employee to open Quick Assist so they can sort a slow machine. For most employees, that is a help desk conversation. In the campaign Microsoft described on 2 November, it was the first step toward minting a domain credential that would keep working after every password was changed.

The advisory, covered by SC Media and drawing on The Hacker News, describes two intrusions with the same shape. In one, attackers posing as IT support convinced employees to start a Quick Assist session, then used remote control to work through a vulnerable Active Directory Certificate Services template — ESC1 — to request certificates for privileged accounts. In the other, the PetitPotam method forced domain controller authentication, and an ESC8 relay captured a domain controller certificate. Microsoft's recommendations are short: verify support requests through an internal channel, disable unnecessary enrollment rights, and enable Extended Protection for Authentication on web enrollment endpoints.

That is the retelling. The part worth slowing down on is what was taken.

The credential that outlives the reset

When an organisation discovers this kind of compromise, the first reflex is usually to reset passwords and expire sessions. That is necessary, but it does not undo the certificate. A certificate issued from AD CS is an independent credential. It can be used to authenticate as the named user or machine without a password, and it remains valid until it expires or is explicitly revoked. In the ESC1 case, a template that allowed the requester to set the subject name let the attacker request a certificate as a privileged account. The public guidance is clear: these methods rest on configuration weaknesses rather than software flaws, so there is no patch. The remedy is operational. Find the misconfigured templates, remove the enrollment rights, and audit what has already been issued.

For most readers, the difficult sentence in that paragraph is the last one. If a certificate was requested as a privileged account, you cannot assume the incident ended when the password changed. The certificate may still be used for authentication until someone finds it and revokes it. That search is not automatic; it depends on whether the identity team knows to look.

Help desk verification is the control

Training the employee to refuse the session matters, but it cannot carry the whole risk alone. In most mid-market firms, one person or a very small team covers first-line support, and Quick Assist is likely a legitimate tool. If the only control is an annual security awareness video, we are asking a user to hold a decision that a procedure should have made. The stronger control is verification: any request for remote access over Teams, phone, or chat is checked against a ticket or a manager-approved callback before Quick Assist is opened.

This is where training becomes useful. A managed cyber awareness programme can simulate the help desk call as realistically as it simulates a phishing link, and it can drill the sentence an employee should use to decline: Let me call the service desk back on the published number. That sentence is not from a policy document; it is the kind of concrete behaviour that survives when a real call comes in. The important part is that the procedure exists on both sides. If an employee calls in, the service desk verifies them. If the service desk calls the employee, the employee verifies back. Caller ID and Teams display names are not identity.

The certificate estate probably predates the team

The harder half of this campaign sits in a service that many organisations of this size set up years ago and then stopped looking at. AD CS was often installed to issue machine certificates for Wi-Fi or RDP, and the person who understood the templates has since left. Templates accumulate enrollment rights, and no one can recall why. The ESC1 condition is usually a matter of who is allowed to enroll and whether the requester can supply the subject name. That is findable without a full PKI modernisation project, but only if someone treats AD CS as part of the identity estate rather than a forgotten utility.

If the service desk is the front door, AD CS is the spare key. The two parts of this campaign meet there. An employee grants remote control, and the attacker then reaches a template that lets them request more authority than they were given. Microsoft's mitigations are not a major engineering effort. They are configuration changes and a verification script.

Three checks for this quarter

Before the next Teams call arrives, there are three things a small infrastructure or identity team can do:

• List every AD CS template with Enroll permission and mark any template where the requester can supply the subject alternative name. A privileged account should not be obtainable through a template an ordinary workstation can request.
• Ask the service desk to write, test, and circulate a verification script for both inbound and outbound support calls. The script should sit next to the phone, not only inside the annual module.
• Enable Extended Protection for Authentication on web enrollment endpoints and remove enrollment rights that do not map to a current system.

The campaign will keep working as long as the first minute of the call stays easy. The decision in front of the risk owner is smaller than that: do we know, right now, whether an ordinary workstation can request a certificate as a domain administrator? If the answer is not immediate, the next audit should start there.