AD FS DKM Master Key Access Detection
This rule detects attempts to access the Active Directory contact object to read the AD FS Distributed Key Manager (DKM) master key value. This activity is identified by monitoring Windows Security Event ID 4662 (An operation was performed on an object) for specific property GUIDs associated with the DKM master key, combined with a successful user login event (Event ID 4624) from the same host within a 5-minute window. This indicates a potential attempt to compromise AD FS for credential theft or persistence.
YARA-L
