Analytics BIOC
Low
✕
A process queried the ADFS database decryption key via LDAP
A process queried the ADFS database decryption key (DKM key) via LDAP.
- Module:
- Identity Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal or Forge Authentication Certificates (T1649)
Detector tags: LDAP Analytics (Client) LDAP Analytics (Server) Active Directory Federation Services Analytics
Attacker's goals:
An attacker wanting to perform a golden SAML attack will want to steal the ADFS token-signing certificates. To steal the token-signing certificates, the attacker will need to access the ADFS database To access the encrypted ADFS database, an attacker will attempt to retrieve the decryption key via an LDAP query.
Investigative actions:
Check if the LDAP search query was allowed for the user (logged on at event time) or process. Check for unusual ADFS logins. Check the process that initiated the query. Investigate the LDAP search query for any suspicious indicators.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- LDAP query explicitly queried the ADFS database decryption key (DKM key) Medium (parent: Low)
- A process explicitly queried the ADFS database decryption key (DKM key) via LDAP Medium (parent: Low)
- LDAP query queried the ADFS database decryption key (DKM key) Low