Examining ESC1 & ESC8: Help Desk Impersonation to AD CS Abuse
New intrusion paths ESC1 and ESC8 reveal attackers leveraging help desk impersonation for remote access, runtime code execution, and Certificate Services abuse through authentication relay and Kerberos techniques.