Executive Summary
Mandiant has detailed a technical evolution of the 'Golden SAML' attack that leverages configuration drift in Active Directory Federation Services (ADFS). In environments where manual certificate rotation is used and 'AutoCertificateRollover' is disabled, the ADFS configuration database (WID) may become a 'ghost'—containing outdated metadata while the active signing key resides only in the system's machine-scoped cryptographic store.
By exploiting this drift, adversaries can bypass traditional detection focused on LSASS or the WID database. Instead, they use Machine DPAPI to extract the active private key directly from the host's RSA key store. This allows for the forgery of SAML assertions that impersonate high-privilege accounts, such as Global Administrators, effectively bypassing MFA and conditional access policies for any federated application, including Microsoft 365.
This technique highlights a critical risk: ADFS private keys are often protected by Machine DPAPI to ensure operational resilience across service restarts. However, this design choice means a SYSTEM-level compromise on an ADFS server allows for silent key extraction without interacting with the live ADFS process or memory.