Detect Microsoft AD FS Insufficient Access Control Granularity Exploitation (CVE-2026-56155) in Microsoft Sentinel
Detects exploitation activity targeting CVE-2026-56155, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Active Directory Federation Services (AD FS). Actively exploited (CISA KEV). The flaw allows an authenticated actor with limited privileges to obtain access to federated resources or claims beyond their intended scope due to coarse-grained authorization decisions in the AD FS relying party trust / claims pipeline, potentially enabling federation token issuance for unauthorized applications or privilege escalation across trusted relying parties. Detection focuses on anomalous AD FS token issuance patterns, unexpected relying party trust access, claims rule modification, and AD FS admin/service account activity outside baseline behavior.
MITRE ATT&CK
KQL Detection Query
// AD FS anomalous relying-party token issuance & claims rule tampering
let lookback = 1d;
union isfuzzy=true
(Event
| where TimeGenerated > ago(lookback)
| where Source == "AD FS Tracing" or Source == "AD FS Auditing"
| where EventID in (1200,1202,342,343,510)
| project TimeGenerated, Computer, EventID, RenderedDescription, UserName=extract(@"UPN:\s*([^\s,]+)", 1, RenderedDescription), RelyingParty=extract(@"Relying Party:\s*([^\r\n]+)", 1, RenderedDescription)),
(SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4713,4739,4670,4662)
| where ObjectName has_any ("ClaimsProviderTrust","RelyingPartyTrust","AccessControlPolicy")
| project TimeGenerated, Computer, EventID, RenderedDescription=Activity, UserName=SubjectUserName, RelyingParty=ObjectName)
| summarize EventCount=count(), DistinctRP=dcount(RelyingParty), RelyingParties=make_set(RelyingParty,20) by UserName, bin(TimeGenerated, 1h)
| where DistinctRP >= 3 or EventCount >= 10
| order by EventCount descCorrelates AD FS tracing/auditing events and Windows Security auditing for a single account accessing an unusually high number of distinct relying party trusts, or performing claims/access-control-policy rule modifications, consistent with exploitation of insufficient access-control granularity in AD FS.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate AD FS administrators performing scheduled trust/claims-rule maintenance
- Federation metadata refresh jobs touching multiple relying parties
- Migration or decommissioning activity per Microsoft's AD FS decommission guidance
- Load balancer or health-probe accounts authenticating across configured RPs
Other platforms for CVE-2026-56155
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate AD FS relying party trust enumeration
Expected signal: AD FS PowerShell module invocation logged in PowerShell Script Block Logging (Event ID 4104) and process creation event for powershell.exe with Get-AdfsRelyingPartyTrust arguments.
- Test 2Simulate unauthorized claims rule modification
Expected signal: Windows Security Event ID 4713 (Kerberos policy change) or AD FS-specific configuration change auditing (Event ID 342/343) plus PowerShell Script Block Logging capturing the Set-AdfsRelyingPartyTrust invocation.
- Test 3Simulate rapid multi-relying-party token requests from single account
Expected signal: AD FS Auditing Event ID 510 (token issuance) logged once per relying party per authentication, correlated to the same UPN within a short time span.
References (5)
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-56155
- https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide
Response Playbook
Triage
- Identify the AD FS server(s) and farm nodes generating the alert; confirm current patch level against Microsoft's CVE-2026-56155 update guidance.
- Pull the flagged account's AD FS token issuance history for the past 7 days and enumerate every relying party trust it accessed, comparing against its expected/authorized RP list.
- Review recent changes to claims provider trusts, relying party trusts, and access control policies (Event IDs 4713/4739/342/343) for unauthorized or unexpected rule modifications.
- Check whether the account's privileges (group membership, AD FS admin role) were recently modified, which could indicate a precursor privilege escalation.
Containment
- Disable or reset credentials for the implicated account and revoke any active AD FS/SSO sessions and refresh tokens issued to it.
- Temporarily restrict or remove the affected relying party trust(s)/access control policies until scope is validated, and apply the Microsoft security update or documented mitigation for CVE-2026-56155.
Evidence Collection
- Export AD FS admin event logs, security token service (STS) trace logs, and Windows Security event logs (4713,4739,4670,4662,342,343,510) covering the incident window for all farm nodes.
- Preserve AD FS configuration database (WID/SQL) snapshots and relying party trust / claims rule XML definitions for forensic comparison against known-good baselines.
Escalation Criteria
- !Evidence of unauthorized token issuance for a relying party outside the account's intended scope, or claims rule tampering by a non-admin account, warrants escalation to incident response.
- !Any confirmed compromise of an AD FS admin/service account or evidence of federation trust modification enabling access to high-value relying parties (e.g., cloud tenant admin apps) should trigger executive/IR escalation given active KEV exploitation status.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
AD FS Admin and Debug/Tracing event logs (Applications and Services Logs > AD FS > Admin, Trace) - >
AD FS configuration database (relying party trusts, claims provider trusts, access control policies) export - >
Windows Security event log entries for object access/modification on AD FS-related directory objects (4713,4739,4670,4662)
Tuning Guidance
Baseline each account's normal set of relying party trusts (RPs) over a 30-day period before enforcing the DistinctRP threshold; service/automation accounts and AD FS farm administrators legitimately touch many RPs and should be added to an allowlist or have a higher threshold. Adjust the EventCount and DistinctRP thresholds based on organizational AD FS trust count — organizations with few configured RPs should lower thresholds, those with hundreds of RPs (e.g., large SaaS federations) should raise them and instead prioritize the claims-rule/access-control-policy modification signal, which is lower-volume and higher-fidelity.
Hunting Queries
Broad hunt for any single identity that has obtained tokens for an unusually large set of relying party trusts over a longer lookback (30 days), useful for baselining normal per-user RP access breadth and surfacing outliers even outside the 1-hour correlation window.
Event
| where Source == "AD FS Auditing"
| where EventID == 510
| extend RP=extract(@"Relying Party:\s*([^\r\n]+)",1,RenderedDescription), User=extract(@"UPN:\s*([^\s,]+)",1,RenderedDescription)
| summarize RPCount=dcount(RP), RPs=make_set(RP) by User
| where RPCount > 5
| order by RPCount descindex=adfs sourcetype="MSFT:ADFS:Auditing" EventCode=510
| rex field=RenderedDescription "Relying Party:\s*(?<RP>[^\r\n]+)"
| stats dc(RP) AS RPCount values(RP) AS RPs by UserName
| where RPCount > 5
| sort -RPCountAtomic Red Team Tests
Uses PowerShell AD FS management cmdlets to enumerate all configured relying party trusts, simulating reconnaissance that would precede scope-abuse exploitation.
Command
powershell.exe -Command "Get-AdfsRelyingPartyTrust | Select-Object Name, Identifier | Format-Table"Cleanup
No state changes made; no cleanup required.Expected Telemetry
AD FS PowerShell module invocation logged in PowerShell Script Block Logging (Event ID 4104) and process creation event for powershell.exe with Get-AdfsRelyingPartyTrust arguments.
Expected Detection
Detections monitoring AD FS admin PowerShell cmdlet usage or process command-line auditing for Get-AdfsRelyingPartyTrust/Get-AdfsClaimsProviderTrust should trigger a low-severity reconnaissance alert.
Adds a permissive custom claims issuance rule to a lab relying party trust to emulate an attacker widening token scope beyond the intended access control granularity (lab environment only).
Command
powershell.exe -Command "$rule = '=> issue(Type = \"http://schemas.microsoft.com/ws/2008/06/identity/claims/role\", Value = \"Admin\");'; Set-AdfsRelyingPartyTrust -TargetName 'LabTestRP' -IssuanceTransformRules $rule"Cleanup
Restore the original issuance transform rules on 'LabTestRP' via Set-AdfsRelyingPartyTrust -TargetName 'LabTestRP' -IssuanceTransformRules $originalRules, or remove the lab RP trust entirely with Remove-AdfsRelyingPartyTrust -TargetName 'LabTestRP'.Expected Telemetry
Windows Security Event ID 4713 (Kerberos policy change) or AD FS-specific configuration change auditing (Event ID 342/343) plus PowerShell Script Block Logging capturing the Set-AdfsRelyingPartyTrust invocation.
Expected Detection
KQL/SPL correlation rules watching for ObjectName containing 'RelyingPartyTrust' combined with claims rule modification events should fire a high-severity access-control-tampering alert.
Scripts sequential authentication requests against multiple lab relying party trusts from the same test account within a short window to emulate abuse of insufficiently scoped access control (lab environment only).
Command
powershell.exe -Command "foreach ($rp in @('https://lab-rp1.local','https://lab-rp2.local','https://lab-rp3.local','https://lab-rp4.local')) { Invoke-WebRequest -Uri \"https://adfs.lab.local/adfs/ls/?wa=wsignin1.0&wtrealm=$rp\" -UseDefaultCredentials -UseBasicParsing | Out-Null }"Cleanup
Terminate any resulting AD FS sessions for the test account via AD FS session revocation, and clear lab RP access logs if used for a shared demo environment.Expected Telemetry
AD FS Auditing Event ID 510 (token issuance) logged once per relying party per authentication, correlated to the same UPN within a short time span.
Expected Detection
The DistinctRP >= 3 within 1h correlation logic in the provided KQL/SPL/QRadar/Sumo/CQL queries should trigger a medium-to-high severity alert for the test account.