ADFS DKM Master Key Export

Hunt Hypothesis

An adversary may be exfiltrating the ADFS DKM Master Key to decrypt sensitive data or credentials, indicating potential credential theft or data breach. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats targeting identity infrastructure.

KQL Query

(union isfuzzy=true 
(SecurityEvent 
| where EventID == 4662 // You need to create a SACL on the ADFS Policy Store DKM group for this event to be created. 
| where ObjectServer == 'DS'
| where OperationType == 'Object Access'
//| where ObjectName contains '<GUID of ADFS Policy Store DKM Group object' This is unique to the domain. Check description for more details.
| where ObjectType contains '5cb41ed0-0e4c-11d0-a286-00aa003049e2' // Contact Class
| where Properties contains '8d3bca50-1d7e-11d0-a081-00aa006c33ed' // Picture Attribute - Ldap-Display-Name: thumbnailPhoto
| extend AccountName = SubjectUserName, AccountDomain = SubjectDomainName
| extend timestamp = TimeGenerated, DeviceName = Computer
),
( WindowsEvent 
| where EventID == 4662 // You need to create a SACL on the ADFS Policy Store DKM group for this event to be created. 
| where EventData has_all('Object Access', '5cb41ed0-0e4c-11d0-a286-00aa003049e2','8d3bca50-1d7e-11d0-a081-00aa006c33ed') 
| extend ObjectServer = tostring(EventData.ObjectServer)
| where ObjectServer == 'DS'
| extend OperationType = tostring(EventData.OperationType)
| where OperationType == 'Object Access'
//| where ObjectName contains '<GUID of ADFS Policy Store DKM Group object' This is unique to the domain. Check description for more details.
| extend ObjectType = tostring(EventData.ObjectType)
| where ObjectType contains '5cb41ed0-0e4c-11d0-a286-00aa003049e2' // Contact Class
| extend Properties = tostring(EventData.Properties)
| where Properties contains '8d3bca50-1d7e-11d0-a081-00aa006c33ed' // Picture Attribute - Ldap-Display-Name: thumbnailPhoto
| extend AccountName = tostring(EventData.SubjectUserName), AccountDomain = tostring(EventData.SubjectDomainName)
| extend timestamp = TimeGenerated, DeviceName = Computer
),
(DeviceEvents
| where ActionType =~ "LdapSearch"
| where AdditionalFields.AttributeList contains "thumbnailPhoto"
| where AdditionalFields.DistinguishedName contains "CN=ADFS,CN=Microsoft,CN=Program Data" // Filter results to show only hits related to the ADFS AD container
| extend timestamp = TimeGenerated, AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain
)
)
| extend Account = strcat(AccountDomain, "\\", AccountName)

Analytic Rule Definition

id: 18e6a87e-9d06-4a4e-8b59-3469cd49552d
name: ADFS DKM Master Key Export
description: | 
  'Identifies an export of the ADFS DKM Master Key from Active Directory.
  References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/, 
  https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
  To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this:
  https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469
  https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339
  '
severity: Medium 
requiredDataConnectors: 
  - connectorId: SecurityEvents 
    dataTypes: 
      - SecurityEvents 
  - connectorId: MicrosoftThreatProtection 
    dataTypes: 
      - DeviceEvents 
  - connectorId: WindowsSecurityEvents
    dataTypes: 
      - SecurityEvents 
  - connectorId: WindowsForwardedEvents
    dataTypes: 
      - WindowsEvent 
queryFrequency: 1d 
queryPeriod: 1d
triggerOperator: gt 
triggerThreshold: 0 
tactics: 
  - Collection
relevantTechniques:
  - T1005
tags:
  - Solorigate
  - NOBELIUM
query:  |
  (union isfuzzy=true 
  (SecurityEvent 
  | where EventID == 4662 // You need to create a SACL on the ADFS Policy Store DKM group for this event to be created. 
  | where ObjectServer == 'DS'
  | where OperationType == 'Object Access'
  //| where ObjectName contains '<GUID of ADFS Policy Store DKM Group object' This is unique to the domain. Check description for more details.
  | where ObjectType contains '5cb41ed0-0e4c-11d0-a286-00aa003049e2' // Contact Class
  | where Properties contains '8d3bca50-1d7e-11d0-a081-00aa006c33ed' // Picture Attribute - Ldap-Display-Name: thumbnailPhoto
  | extend AccountName = SubjectUserName, AccountDomain = SubjectDomainName
  | extend timestamp = TimeGenerated, DeviceName = Computer
  ),
  ( WindowsEvent 
  | where EventID == 4662 // You need to create a SACL on the ADFS Policy Store DKM group for this event to be created. 
  | where EventData has_all('Object Access', '5cb41ed0-0e4c-11d0-a286-00aa003049e2','8d3bca50-1d7e-11d0-a081-00aa006c33ed') 
  | extend ObjectServer = tostring(EventData.ObjectServer)
  | where ObjectServer == 'DS'
  | extend OperationType = tostring(EventData.OperationType)
  | where OperationType == 'Object Access'
  //| where ObjectName contains '<GUID of ADFS Policy Store DKM Group object' This is unique to the domain. Check description for more details.
  | extend ObjectType = tostring(EventData.ObjectType)
  | where ObjectType contains '5cb41ed0-0e4c-11d0-a286-00aa003049e2' // Contact Class
  | extend Properties = tostring(EventData.Properties)
  | where Properties contains '8d3bca50-1d7e-11d0-a081-00aa006c33ed' // Picture Attribute - Ldap-Display-Name: thumbnailPhoto
  | extend AccountName = tostring(EventData.SubjectUserName), AccountDomain = tostring(EventData.SubjectDomainN

Required Data Sources

MITRE ATT&CK Context

• Tactic: Collection
• Technique: T1005 — T1005

References

• Source Query

False Positive Guidance

• Scenario: Scheduled ADFS Key Backup Job
  Description: A legitimate scheduled task runs to back up the ADFS DKM Master Key as part of disaster recovery or compliance procedures.
  Filter/Exclusion: Exclude events where the source is a known backup tool or scheduled job (e.g., Task Scheduler with task name containing “ADFSDKMBackup” or Backup Exec).

• Scenario: Admin Manual Key Export for Audit
  Description: An administrator manually exports the ADFS DKM Master Key for audit or forensic analysis using the Export-AdfsDkmMasterKey PowerShell cmdlet.
  Filter/Exclusion: Exclude events where the user is a domain admin or has a specific role (e.g., User = "DomainAdmins\AuditTeam") or the command is part of an approved audit process.

• Scenario: ADFS Configuration Change via PowerShell
  Description: A PowerShell script is run to modify ADFS configuration, which may inadvertently trigger the export of the DKM Master Key during configuration changes.
  Filter/Exclusion: Exclude events where the script is known and approved (e.g., ScriptName = "ADFSConfigUpdate.ps1") or the user is a privileged admin with documented access.

• Scenario: Third-Party Tool for Key Management
  Description: A third-party key management tool (e.g., HashiCorp Vault, Azure Key Vault) is integrated with ADFS and may export the DKM Master Key as part of its synchronization process.
  Filter/Exclusion: Exclude events where the source is a known third-party tool (e.g., ProcessName = "vault-agent.exe" or ProcessName = "azurekeyvault.exe") or the tool is part of an approved integration.

• Scenario: False Positive from Log Collection Tool
  Description: A log collection or