Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-07 and was added to the RWP archive on 2026-09-07.
ADFS token-signing keys live in Machine DPAPI — a “rotated” cert in the database can be a ghost
Mandiant 7 July 2026 — when AutoCertificateRollover is off, the WID/SQL row may still decrypt a key the service no longer uses. The live signing key is machine DPAPI under S-1-5-18. SYSTEM on the ADFS box is SAML.
Bottom line up front
CONFIRMED as Mandiant 7 July 2026: in ADFS farms that disable AutoCertificateRollover and rotate token-signing certs by hand, the configuration database often keeps a decryptable private-key blob that is no longer what the service uses. Operators who dump WID/SQL and decrypt that row can mint SAML for a ghost cert. The active key Mandiant recovered in the assessed environment sat in Machine DPAPI (machine key store, DPAPI_SYSTEM LSA secret, masterkeys under C:\Windows\System32\Microsoft\Protect\S-1-5-18\). SharpDPAPI /machine confirmed it; CNG Crypto\Keys was not in use there.
ASSESSED This is a post-exploitation identity paper, not a new CVE. If you already have SYSTEM on the ADFS server, you can forge tokens without the “golden SAML” DKM story everyone tabletopped in 2020–21. Hunt both stores.
What happened
Five-step flow Mandiant diagrammed: SYSTEM → machine DPAPI artifacts → active token-signing private key → SAML assertion. The database is necessary but not sufficient when rollover is manual.
Why it matters
ADFS is still how a lot of regulated mid-market talks to SaaS. A stale IR playbook that only checks the SQL blob will miss the live key.
What is confirmed vs not
CONFIRMED Mandiant technique and ghost-row finding.
NOT: a named APT using it in that post.
UNKNOWN how common disabled AutoCertificateRollover still is.
What defenders should do
- Prefer AutoCertificateRollover; if you cannot, inventory which store the service actually uses.
- ADFS servers are Tier-0. SYSTEM dump = assume SAML forgery.
- Monitor token-signing cert changes and anomalous SAML issuers.
RWP assessment
Confidence: High on the mechanics. Brief it to identity teams, not as “new ransomware.”
Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-07 and was added to the RWP archive on 2026-09-07.
Sources
- Mandiant/GTIG — Recovering active ADFS signing keys via Machine DPAPI
- Mandiant — APT29 credential roaming / DPAPI context (prior)
- Microsoft — ADFS token-signing certificate operations (vendor documentation)