Analytics BIOC
Low
✕
ADFS DKM Key Access
ADFS DKM key attribute (thumbnailphoto) access in AD container, potential Golden SAML token forging attempt.
- Module:
- Identity Threat Detection (ITDR)
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Forge Web Credentials: SAML Tokens (T1606.002)
Detector tags: Active Directory Federation Services Analytics
Attacker's goals:
The attack goal is to forge a valid SAML token to impersonate any user and gain persistent, unauthorized access to cloud resources, effectively bypassing MFA and standard security controls.
Investigative actions:
Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue. Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack. Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day