Act
active
Teams IT-Support Vishing + AD CS Abuse Leads to Domain Compromise
- Engineer — Plan: Confirmed active exploitation of overly permissive AD CS certificate templates to mint privileged-account certs — no KEV/PoC signal, but real intrusions warrant a scheduled audit. Run Certify or PSPKIAudit against your AD CS deployment to identify ESC-class misconfigurations and tighten enrollment permissions on certificate templates.
- SOC/IR — Act: Two confirmed intrusions with actionable detection surface: hunt for anomalous AD CS certificate issuance events (Windows Event IDs 4886/4887) for privileged accounts since October, and review Microsoft Teams external-user remote-control session logs for vishing patterns. TTPs map to ATT&CK T1649 (Steal or Forge Authentication Certificates).
- Leader — Plan: Microsoft-confirmed intrusions via Teams impersonation plus identity-infrastructure abuse are a prompt to review external Teams access policy and schedule an AD CS configuration assessment — neither is urgent enough for a board brief today, but both belong on the Q4 identity security roadmap.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.