Activity overview Attack chain overview Portable runtime staging and execution variants Host discovery and AD CS assessment Case 1: ESC1 abuse and the cost of an identity exclusion Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity Why the response outcomes differed Actionable investigation methods References Learn More Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages…
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
About this summary. This is a short excerpt from the description that Microsoft Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
Source attribution: headline and facts are from Microsoft Security (microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
69Critical 1337Important 0Moderate 1Low Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the…
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale SOCRadar Dark Web Team identified several new…
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Table Of ContentsTable of ContentsDefenderKiller Exploits a Legacy Microsoft DriverImplications for Endpoint SecurityIndicators of Compromise and Technical ArtifactsStay…
What happens when security tools go dark before the ransomware
On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four…
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept…
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0…