From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.
Security
Discover what’s coming to Microsoft Ignite, Nov 17-20, 2026. Register now.
Get started with Microsoft Security
Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft.
Connect with us on social