CVE-2026-56155 — AD FS Distributed Key Manager ACL Weakness → Golden SAML

CVE-2026-56155 is an actively-exploited elevation-of-privilege flaw in Microsoft Active Directory Federation Services (AD FS), patched in the July 2026 "Patch Tuesday". Microsoft classifies it as "insufficient granularity of access control" around the AD FS Distributed Key Manager (DKM) container. AD FS stores, inside a container object in Active Directory, the symmetric key that protects the private keys of its token-signing and token-decryption certificates. If that container's ACL is overly permissive, an attacker who already holds read access to the DKM key material can decrypt the token-signing private key. Zero Day Initiative analysts flagged it as the only actively-exploited AD FS bug among several Microsoft patched this cycle; CISA added it to the KEV catalog on 2026-07-14.

Recovery of the token-signing key is the doorway to Golden SAML (MITRE T1606.002): with the signing key an attacker forges SAML authentication tokens that downstream relying parties — Microsoft 365, Entra ID, and any SAML-federated SaaS — accept as legitimate, because each token carries a valid federation signature. A Golden SAML token can assert any user, any group, at any MFA level. It is not stopped by password resets or MFA, and it survives long after the initial foothold: the only durable fix is to remediate the DKM ACL and rotate the token-signing / decryption certificates.

The defensive challenge is that the crown-jewel step — decrypting the key and minting tokens — happens offline, so it produces little direct endpoint telemetry. The hunt therefore anchors on the reachable tradecraft around it: execution of known AD FS / Golden-SAML dumping tooling (AADInternals, ADFSDump, Mimikatz), the AD FS service host spawning shells, processes referencing the DKM container or token-signing cert, directory reconnaissance of the AD FS configuration objects, and the native Event ID 1132 the July update now logs when the DKM ACL is insecure.

Defender priority: Treat every AD FS server as a Tier-0 asset and assume the token-signing key is at risk until proven otherwise. Do three things now — (1) apply the July 2026 AD FS update and set the RemediateDkmAcl registry key to enforce (audit mode alone only logs), (2) audit who can read the DKM container and remove all but the AD FS service account, and (3) rotate the token-signing and token-decryption certificates twice and re-establish federation trust. Then hunt with Q1–Q6 and the S7 native audits.

Intel gap (perishability): As of the pack date no vendor has published campaign-specific atomic IOCs (tool hashes, C2, actor infrastructure) tied to CVE-2026-56155 exploitation. This pack is therefore behavior-anchored; the IOC appendix ships REPLACE_WITH_… placeholders to fill the moment your IR team or a vendor report yields campaign atomics. No atomic indicator here is fabricated.

Hunt hypotheses (fidelity-ordered)

Attack chain

This is a behavior-first pack. The atomic rows below are placeholders to be populated from your IR findings or a vendor report; the behavioral rows are the operative indicators today.

• AD FS Admin — Event ID 1132: After the July 2026 update, this event is logged when the DKM container ACL is insecure. Every 1132 is a direct exposure signal — triage the host and remediate the ACL. Also review Events 307 / 510 (configuration changes) and 1200 / 1202 (token issuance) for anomalies.
• Directory Service Access — Event 4662: Enable SACL auditing on the AD FS DKM container object and alert on reads by any principal other than the AD FS service account. This is the closest thing to catching the key-material read directly.
• Golden-SAML correlation: Forged tokens are minted off AD FS, so there is no corresponding AD FS 1200/1202 issuance event for them. Hunt Entra / M365 sign-ins that assert federation but have no matching on-prem AD FS authentication in the same window — especially with unusual IssuerUri, impossible travel, or authentication-instant skew.
• Federation trust tampering: Review Entra ID audit logs for new or modified federated domains / issuance signing certificates (a related backdoor: adding an attacker-controlled token-signing cert). Alert on Set-MsolDomainFederationSettings / domain-federation changes.
• DKM ACL baseline: Snapshot the ACL on the DKM container and the membership of any group granted read; diff periodically.

Promote Q1 and Q2 to blocking IOAs immediately (near-zero legitimate use); keep Q3–Q6 as investigate-only scheduled searches until tuned to your farm.

• Telemetry ready: Confirm Falcon sensors are installed and reporting on every AD FS farm node and Web Application Proxy, and that DC Event 4662 SACL auditing on the DKM object plus the AD FS Admin channel (1132/1200) are forwarded to LogScale / NGSIEM.
• Benign baseline: Run Q3 and Q4 across a normal admin/maintenance window first to learn legitimate Get-AdfsProperties and inventory noise, then apply the TUNING exclusions before alerting.
• Positive test: In a lab, run a benign command line containing the string Export-AADIntADFSSigningCertificate and confirm Q1 fires; launch cmd.exe from the AD FS service-host context and confirm Q2 fires.
• Promotion: Q1/Q2 can go to blocking IOAs immediately given near-zero legitimate use; baseline Q3–Q6 for a rolling week before promotion.

Confirm the DKM ACL remediation is ENFORCED (not just audit)

# Audit mode logs Event 1132; enforcement fixes the ACL. Confirm/opt into enforcement.
# Per Microsoft KB5121391 — set on each AD FS server, then restart the AD FS service.
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ADFS" -Name RemediateDkmAcl `
  -Value 1 -PropertyType DWORD -Force
Restart-Service adfssrv
# Verify no further Event 1132 is logged in the AD FS/Admin channel after restart:
Get-WinEvent -LogName "AD FS/Admin" -MaxEvents 200 |
  Where-Object { $_.Id -eq 1132 } | Select-Object TimeCreated, Id, Message

Rotate AD FS token-signing / decryption certificates (run after ACL remediation)

Add-PSSnapin Microsoft.Adfs.PowerShell -ErrorAction SilentlyContinue
# Temporarily allow AD FS to manage new self-signed certs, then roll twice.
Set-AdfsProperties -AutoCertificateRollover $true
Update-AdfsCertificate -CertificateType Token-Signing -Urgent
Update-AdfsCertificate -CertificateType Token-Decrypting -Urgent
# Repeat the Token-Signing roll a second time so the previously-primary key is retired:
Update-AdfsCertificate -CertificateType Token-Signing -Urgent
# Re-push federation metadata to Entra ID and every relying party:
Update-MSOLFederatedDomain -DomainName "internal-host.example.com" -SupportMultipleDomain

Audit who can read the DKM container

# Locate the AD FS DKM group/container and dump its ACL; only the AD FS service
# account should have read on the key material.
Import-Module ActiveDirectory
$adfs = Get-ADObject -LDAPFilter "(name=ADFS)" -SearchBase (Get-ADRootDSE).defaultNamingContext `
  -SearchScope Subtree
$adfs | ForEach-Object {
  Write-Host "== $($_.DistinguishedName) =="
  (Get-Acl "AD:$($_.DistinguishedName)").Access |
    Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType | Format-Table -Auto
}

Gaps: The token-forgery step is performed off the AD FS host and endpoint telemetry cannot see it — the only reliable control is certificate rotation (S12/S14), not detection. Forged-token use is visible only in Entra / M365 sign-in logs (S7 correlation), and the DKM read is best caught with DC Event 4662 SACL auditing. Populate the atomic IOC placeholders (S10) once IR yields tool hashes / C2.