Threat Hunt Plan: Microsoft AD FS DKM Access-Control Abuse and Golden SAML Token Forgery

July 17, 2026 — Revision 1.0

Hunt Objective and Scope

This hunt seeks evidence that an attacker has exploited insufficient access-control granularity on the Active Directory Federation Services (AD FS) Distributed Key Management (DKM) container (CVE-2026-56155, CVSS 7.8) to read token-signing and token-encryption key material, elevate privileges on a federation server, and forge SAML authentication tokens (Golden SAML) for the federated estate. The vulnerability was reported as exploited in the wild as a zero-day and was added to the CISA Known Exploited Vulnerabilities catalog on July 14, 2026 with a federal remediation deadline of July 28, 2026; Microsoft credited discovery to its Detection and Response Team (DART), indicating identification during a live intrusion.

Environment in scope: all AD FS primary and secondary federation servers, the Active Directory forest that stores the DKM container (CN=ADFS under the service Program Data node), Web Application Proxy (WAP) hosts fronting AD FS, and the relying-party applications and identity providers that consume AD FS-issued tokens. Endpoint telemetry is drawn from CrowdStrike Falcon and Windows event logs on federation servers and domain controllers; network telemetry from the segments carrying AD FS management and federation traffic.

Time window: review the trailing 180 days at minimum. Because DART discovered this during active exploitation and token-forging activity can predate the patch, extend historical review of DKM container access and token-signing certificate activity to the full retention available (preferably one year). This is both a patch-verification and a compromise-assessment exercise; a finding of a permissive DKM ACL does not by itself prove compromise, but it requires the historical hunt below.

Hypotheses and Hunt Procedures

Hypothesis 1: An attacker with low-privileged local access to an AD FS server has read the DKM container key material through an overly permissive access control list to recover token-signing and token-encryption private keys, observable as anomalous LDAP/registry access to the DKM container and AD FS certificate-handling process activity in Windows Security logs, the AD FS Admin log, and CrowdStrike process telemetry.

MITRE ATT&CK: Credential Access | T1552.004 — Unsecured Credentials: Private Keys | An attacker recovers the AD FS token-signing private key from DKM key material protected only by a misconfigured container ACL.

Collection Queries:

CrowdStrike Falcon FQL — processes touching the DKM container or AD FS certificates on federation servers:

Windows Event IDs to collect — AD FS DKM ACL audit events introduced by the July 14, 2026 update (Event IDs 1132-1136 in the AD FS/Admin log signal an insecure DKM container ACL requiring attention) and directory object access:

Datadog — Windows log visibility for AD FS DKM ACL events (prerequisite: Windows event log integration forwarding the AD FS/Admin and Security channels):

YARA file-system scan — dropped AD FS certificate-export or DKM-extraction tooling on federation servers:

Analysis Queries:

CrowdStrike Falcon FQL — rarity of process execution on AD FS hosts (rarest first is most suspicious):

Windows Event Log PowerShell analysis — correlate DKM ACL alerts across the AD FS farm:

Datadog Log Analytics — AD FS DKM ACL alert distribution:

Datadog Monitor (log alert):

Hypothesis 2: An attacker has forged SAML authentication tokens using a stolen AD FS token-signing certificate (Golden SAML), observable as relying-party sign-ins with no corresponding AD FS token-issuance record, and as execution of token-forging tooling or certificate-export activity on or against federation servers.

MITRE ATT&CK: Credential Access | T1606.002 — Forge Web Credentials: SAML Tokens | With the token-signing private key an attacker mints SAML assertions that relying parties accept without AD FS ever authenticating the account.

Collection Queries:

CrowdStrike Falcon FQL — Golden SAML and AD FS dumping tool execution:

Windows Event IDs to collect — PowerShell script block logging (EID 4104) for token-forging cmdlets, and AD FS token-issuance audit events for reconciliation against relying-party logs:

Datadog — Windows visibility for token-forging tooling (prerequisite: PowerShell Operational channel forwarded):

Analysis Queries:

CrowdStrike Falcon FQL — rarity of certificate/key export activity (rarest first):

Windows Event Log PowerShell analysis — reconcile relying-party successful sign-ins against AD FS token issuance to surface tokens the AD FS server never issued (the Golden SAML blind spot):

Datadog Log Analytics — token-forging tooling execution over time:

Datadog Monitor (log alert):

Hypothesis 3: An attacker established the initial local foothold on an AD FS server and moved laterally or dumped credentials to reach the federation service context, observable as remote logons from unexpected sources, inbound administrative protocol connections, and LSASS credential-access activity on federation servers.

MITRE ATT&CK: Lateral Movement | T1021.006 — Remote Services: Windows Remote Management | Credential Access | T1003.001 — OS Credential Dumping: LSASS Memory | An attacker pivots to the AD FS host over WinRM/RDP/SMB and harvests credentials to run in the AD FS service context.

Collection Queries:

CrowdStrike Falcon FQL — remote (network/interactive) logons to AD FS hosts from routable sources:

CrowdStrike Falcon FQL — inbound administrative protocol connections accepted by AD FS hosts:

Windows Event IDs to collect — logon and remote-management events on federation servers:

BPF packet capture — rolling capture of administrative protocols on the AD FS management interface:

Analysis Queries:

CrowdStrike Falcon FQL — LSASS credential-dumping techniques on federation servers:

Wireshark / tshark — extract source addresses of WinRM sessions to the AD FS host for baseline deviation:

YARA memory scan — credential-dumping artifacts in process memory on AD FS hosts (SeDebugPrivilege required; can be executed remotely via CrowdStrike Falcon Real Time Response):

Datadog Log Analytics — inbound remote logons to AD FS hosts by source (prerequisite: Security channel forwarded):

Datadog Monitor (log alert):

Threat Actor Profile

The primary threat is a capable, financially or espionage-motivated intrusion set operating post-initial-access. DART's discovery of CVE-2026-56155 during live incident response indicates real-world use by an actor already inside victim networks. Sophistication is moderate-to-high: the actor understands AD FS internals, the DKM key hierarchy, and Golden SAML tradecraft, and is comfortable operating quietly against identity infrastructure. Access path: an existing foothold on a networked host, then movement to an AD FS server via stolen credentials, exposed administration, or a chained remote code execution flaw, followed by exploitation of the permissive DKM ACL to reach administrator and recover token-signing keys.

TTPs align with identity-provider compromise campaigns historically associated with advanced nation-state groups (for example the actors behind large-scale SAML token-forgery incidents) as well as ransomware affiliates who pair a remote code execution vulnerability with this local escalation to reach domain-wide impact. Once the signing certificate is recovered, the actor can forge tokens for any relying party (Golden SAML), persist through certificate trust rather than credentials, and bypass multi-factor authentication because AD FS never processes the forged authentication. Ransomware crews are expected to use the same chain for rapid privilege consolidation before encryption.

Data Sources Required

Endpoint: CrowdStrike Falcon (ProcessRollup2, NetworkReceiveAcceptIP4, UserLogon telemetry) on all federation servers and domain controllers; Windows Security event log (4624, 4625, 4648, 4662); AD FS/Admin operational log (DKM ACL events 1132-1136, token-issuance event 299); PowerShell Operational log (4104 script block).

Directory: Active Directory object-access auditing on the DKM container (CN=ADFS service Program Data node), AD FS service-account and gMSA activity, certificate-store and token-signing/token-encryption certificate lifecycle events.

Network: PCAP/NetFlow and firewall logs for the AD FS management and federation segments; WAP access logs; relying-party and application sign-in logs for reconciliation against AD FS token issuance.

Configuration state: DKM container ACL, the RemediateDkmAcl registry key state, patch level (KB5121391 and related builds), and AD FS farm topology.

Detection Signatures

SIGMA Rule 1 — process_creation: AD FS DKM / token-signing certificate handling by interactive tooling:

SIGMA Rule 2 — security object access: directory access to the DKM container:

SIGMA Rule 3 — ps_script: Golden SAML and AD FS dumping cmdlets:

Snort/Suricata Rule 1 — Golden SAML tooling user-agent to federation endpoints:

Snort/Suricata Rule 2 — anomalous WinRM to AD FS management interface:

YARA Rule 1 (file/disk artifacts) — this rule targets AD FS credential-theft tooling and exported key material dropped to disk on a federation server. The condition ORs three artifact classes (named tooling strings, AD FS dumping cmdlet strings, and exported private-key file markers) so a hit on any single class fires; the private-key markers are fullword-anchored to reduce matches on benign certificate documentation.

YARA Rule 2 (process memory) — this rule targets credential-dumping tools resident in process memory on an AD FS host, covering the standard LSASS-theft toolset. Each branch pairs a tool indicator with a process/context anchor (lsass) or a memory-read API so that a lone benign string does not fire; the fifth branch is an API-plus-target catch-all for tooling not matched by name.

Indicators of Compromise

Network IOCs (behavioral, scoped to this hunt): inbound WinRM (5985/5986), RDP (3389), or SMB (445) sessions to AD FS servers from sources outside the sanctioned administrative range; HTTP requests to federation endpoints carrying the AADInternals user-agent; relying-party sign-ins with no corresponding AD FS token-issuance record.

Host IOCs: AD FS/Admin Event IDs 1132-1136 indicating an insecure DKM container ACL; Security Event ID 4662 object access referencing the DKM/CryptoPolicy container; PowerShell EID 4104 containing AADInternals, ADFSDump, or Export-AADIntADFS; exported .pfx/.pvk key files on a federation server; LSASS access via comsvcs.dll MiniDump, procdump, or Mimikatz.

Operational IOCs: unexpected changes to the AD FS service account or gMSA; token-signing/token-encryption certificate creation, export, or rollover outside a change window; new local administrators on federation servers.

False Positive Baseline

1. Scheduled AD FS token-signing/encryption certificate auto-rollover performed by the AD FS service account.

2. Authorized administrators running Get-AdfsCertificate or Get-AdfsProperties during maintenance from sanctioned jump hosts.

3. Backup and migration jobs invoking Export-PfxCertificate against the certificate store within an approved change window.

4. Monitoring, patch-management, and vulnerability-scanning agents opening WinRM/RDP/SMB sessions to AD FS servers from known management subnets.

5. Security tooling (including AADInternals used by the internal red team) executed from documented assessment hosts with prior authorization.

Escalation Criteria

1. Any YARA hit on ADFS_Cert_Export_Tooling against a federation server file system (exported key material or AD FS dumping tooling on disk).

2. Any YARA hit on Credential_Dump_Tool_Memory_Artifacts against lsass.exe or another process on an AD FS host.

3. A relying-party successful sign-in with no matching AD FS token-issuance event (EID 299) — a candidate forged (Golden SAML) token.

4. Security 4662 object access to the DKM/CryptoPolicy container by any principal other than the AD FS service account.

5. PowerShell 4104 evidence of AADInternals, ADFSDump, or Export-AADIntADFS execution on or against a federation server.

6. Confirmation that the DKM container ACL was permissive (AD FS/Admin 1132-1136) combined with any remote logon to the host from an unsanctioned source.

Hunt Completion Criteria and Reporting

The hunt is complete when: every AD FS server has been confirmed patched (KB5121391 or the applicable build) and cycled so DKM ACL auditing is active; AD FS/Admin Events 1132-1136 have been reviewed farm-wide and any permissive DKM container ACL has been remediated (RemediateDkmAcl set or the ACL corrected); the trailing 180-day (preferably one-year) window of DKM object access, token-signing certificate activity, remote logons, and credential-dumping indicators has been reviewed; and relying-party sign-ins have been reconciled against AD FS token issuance for the review window.

The report must document: patch and DKM ACL remediation status per federation server; all escalations raised under Section 8 and their disposition; any evidence of DKM key material access, token forgery, credential dumping, or unauthorized lateral movement; and, where compromise cannot be ruled out, a recommendation to rotate the token-signing and token-encryption certificates (twice, to fully retire the exposed keys) and to treat the identity trust as suspect until rotation completes. Include the queries run, time windows, hosts covered, and any data-source gaps (for example channels not forwarded to the SIEM/Datadog) that limited coverage.

Advisory IoC Reference