ADFS: attacks, detection & hardening

ADFS, short for Active Directory Federation Services, is a Microsoft identity federation component that enables claims-based authentication across organizational and cloud boundaries. ADFS issues signed SAML tokens that grant access to relying party applications without requiring direct credential exchange. It relies on a token signing certificate stored on the ADFS server to cryptographically assert identity claims. The service is deeply integrated with Active Directory: user attributes are pulled from AD and embedded as claims in issued tokens. Because ADFS sits at the intersection of on-premises AD and cloud services such as Microsoft 365 or Azure AD, it represents a high-value target for attackers. Compromising ADFS grants the ability to forge authentication tokens for any federated application. This technique, known as Golden SAML, mirrors the impact of a Kerberos Golden Ticket but applies to SAML-based federation. The attack surface includes the ADFS configuration database, the token signing certificate, and the service account running the ADFS process.

Detecting ADFS-related attacks requires monitoring both Windows event logs and ADFS-specific audit logs. Enable ADFS auditing via the ADFS Management console and collect events from the AD FS audit source in the Security event log. Event ID 1202 logs successful token issuances. Event ID 1000 and 1001 cover ADFS service start and stop. Suspicious patterns include token issuances for users outside business hours, tokens issued for disabled accounts, or an abnormally high volume of SAML assertions from a single IP. Monitor access to the ADFS configuration database located at HKLM/SYSTEM/CurrentControlSet/Services/adfssrv. The token signing certificate private key is stored in the Windows certificate store: any process accessing it outside the ADFS service account context is a strong indicator of compromise. Export attempts of the DKM (Distributed Key Manager) key from Active Directory, stored under the ADFS container in AD, should trigger immediate alerts. Tools such as Microsoft Sentinel with the ADFS connector, or Splunk with the Windows TA, can correlate these signals efficiently. SIEM rules should also flag lateral movement toward the ADFS server itself.

Red Team operators targeting ADFS typically pursue the Golden SAML attack chain. The first step is to extract the token signing certificate from the ADFS server. This requires local administrator or SYSTEM access on the ADFS host. The tool ADFSDump, developed by FireEye Mandiant, automates extraction of both the token signing certificate and the DKM encryption key from Active Directory. With these artifacts, an attacker uses AADInternals to forge arbitrary SAML tokens for any user in the federated domain, including cloud-only accounts or global administrators. The forged token bypasses multi-factor authentication entirely because MFA enforcement happens before token issuance. Hardening measures include rotating the token signing certificate regularly and limiting who holds local admin rights on ADFS servers. Enforce tiered administration: ADFS servers belong to Tier 0 and must be treated with the same sensitivity as domain controllers. Enable ADFS Extranet Lockout and Smart Lockout to reduce credential stuffing exposure. Restrict network access to the ADFS management endpoint and monitor the AD container CN=ADFS,CN=Microsoft,CN=Program Data using AD audit policies to detect DKM key read attempts. Regularly audit relying party trusts to remove stale or unauthorized entries.