TLDR Tech / InfoSec
The ‘Ghost' in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI
Mandiant documented a Golden SAML variant where, in ADFS environments with AutoCertificateRollover disabled and certificates manually rotated, the WID configuration database holds a stale “ghost” certificate while the live token-signing key sits in the machine-scoped CAPI store protected by Machine DPAPI rather than a user-bound context. An attacker with SYSTEM on the ADFS host recovers that active key via the DPAPI_SYSTEM LSA secret and machine masterkeys, then forges a Global Administrator SAML assertion that Entra ID accepts, all without touching LSASS or the live ADFS process. Defenders should treat ADFS as Tier 0, migrate signing keys to an HSM, set SACL auditing on the MachineKeys and Protect\S-1-5-18 paths, correlate ADFS issuance logs against Entra ID sign-ins, and watch for Event ID 385 as a drift indicator after manual rotation.
Read the full story