A retired certificate in the database, a live key on disk: how Mandiant pulled an ADFS signing key and forged Global Administrator
2026-08-17Security
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.
