42 matches found
ADFSDump
ADFSDump A C tool to dump all sorts of goodies from AD FS. Created by Doug Bienstock @doughsec while at Mandiant FireEye. This tool is designed to be run in conjunction with ADFSpoof. ADFSdump will output all of the information needed in order to generate security tokens using ADFSpoof. Detailed...
CVE-2026-72978
Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
CVE-2026-72978
CVE-2026-72978 is a Medium severity (CVSS 5.9) denial-of-service vulnerability in Active Directory Federation Services (AD FS) . The root cause is allocation of resources without limits or throttling , allowing an unauthorized, unauthenticated attacker to cause a remote denial of service . The at...
New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems
Cybersecurity researchers have disclosed a new attack technique called Silver SAML that can be successful even in cases where mitigations have been applied against Golden SAML attacks. Silver SAML "enables the exploitation of SAML to launch attacks from an identity provider like Entra ID against...
Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers
The threat actor behind the SolarWinds supply chain attack has been linked to yet another "highly targeted" post-exploitation malware that could be used to maintain persistent access to compromised environments. Dubbed MagicWeb by Microsoft's threat intelligence teams, the development reiterates...
MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone
Updated August 26, 2022: Added instructions to enable collection of AD FS event logs in order to search for Event ID 501, and added a new resource for AD FS audit logging in Microsoft Sentinel. Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, whi...
MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone
Updated August 26, 2022: Added instructions to enable collection of AD FS event logs in order to search for Event ID 501, and added a new resource for AD FS audit logging in Microsoft Sentinel. Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, whi...
5 ways to connect with Microsoft Security at Identiverse 2022
Identiverse is where the industry gathers to discuss all things identity. The 2022 conference will take place June 21 to 24 in Denver, Colorado, and I’m absolutely thrilled that Microsoft will be there. At Identiverse, we’ll share how we help customers secure access in a hybrid, multicloud, and...
CVE-2021-40456
Windows AD FS Security Feature Bypass Vulnerability...
Security feature bypass
Windows AD FS Security Feature Bypass Vulnerability...
CVE-2021-40456
CVE-2021-40456 is a Windows AD FS Server vulnerability described as a security feature bypass . The affected component is Active Directory Federation Services on Windows Server; the core issue is bypassing security restrictions within AD FS. Microsoft and security advisories indicate updates/fixe...
CVE-2021-40456 Windows AD FS Security Feature Bypass Vulnerability
...
CVE-2021-40456 Windows AD FS Security Feature Bypass Vulnerability
...
Windows AD FS Security Feature Bypass Vulnerability
...
SolarWinds Attackers Hit Active Directory Servers with FoggyWeb Backdoor
The threat actors behind the notorious SolarWinds supply-chain attacks have dispatched new malware to steal data and maintain persistence on victims’ networks, researchers have found. Researchers from the Microsoft Threat Intelligence Center MSTIC have observed the APT it calls Nobelium using a...
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor
Microsoft continues to work with partners and customers to track and expand our knowledge of the threat actor we refer to as NOBELIUM, the actor behind the SUNBURST backdoor, TEARDROP malware, and related components. As we stated before, we suspect that NOBELIUM can draw from significant...
CVE-2021-33779
Windows AD FS Security Feature Bypass Vulnerability...
Security feature bypass
Windows AD FS Security Feature Bypass Vulnerability...