CVE-2026-56155: Microsoft AD FS Access Control Vulnerability — CISA KEV and Defensive Response

---
title: Potential AD FS Privilege Escalation via Sensitive Privilege Assignment
id: 8a1c2b3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the assignment of sensitive privileges (e.g., SeDebugPrivilege) to a non-system account on AD FS servers, which may indicate exploitation of access control vulnerabilities.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4672
  filter_legit_system:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
      - 'ADMINISTRATOR'
  filter_legit_groups:
    SubjectLogonId: '0x3e7' # Local System
  condition: selection and not 1 of filter_legit_*
falsepositives:
  - Legitimate administrative activity by domain admins
level: high
---
title: AD FS Configuration Database Modification via PowerShell
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects attempts to modify the AD FS configuration using the Microsoft.IdentityServer.PowerShell module by non-administrative users.
references:
  - https://learn.microsoft.com/en-us/powershell/module/adfs/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1547.012
logsource:
  category: process_creation
  product: windows
detection:
  selection_module:
    CommandLine|contains:
      - 'Import-Module Microsoft.IdentityServer.PowerShell'
      - 'Add-AdfsRelyingPartyTrust'
      - 'Set-AdfsClaimsProviderTrust'
  selection_user:
    SubjectUserName|contains:
      - 'ADFS$'
      - 'Svc_ADFS'
  condition: selection_module and not selection_user
falsepositives:
  - Authorized AD FS administration
level: high
---
title: Access to AD FS Configuration Artifacts
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects access to the AD FS configuration directory or key export files by unusual processes.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663
    ObjectType|contains:
      - 'FileObject'
      - 'Key'
    ObjectName|contains:
      - 'C:\Windows\ADFS'
      - 'C:\Program Files\Active Directory Federation Services'
      - 'Microsoft.IdentityServer.Servicehost.exe.config'
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
  - Backup software accessing ADFS config
  - Legitimate admin access
level: medium

// Hunt for sensitive privilege assignments and AD FS related process anomalies
let ADFSServers = DeviceProcessEvents 
  | where ProcessName has @"Microsoft.IdentityServer.Servicehost.exe" 
  | summarize by DeviceName;
SecurityEvent 
  | where DeviceName in (ADFSServers) 
  | where (EventID == 4672 and SubjectUserName !contains "$" and SubjectUserName !in ("Administrator", "DOMAIN ADMINS")) 
      or (EventID == 4688 and NewProcessName contains @"powershell.exe" and CommandLine contains @"Microsoft.IdentityServer") 
  | project TimeGenerated, DeviceName, SubjectUserName, EventID, NewProcessName, CommandLine, SubjectLogonId 
  | order by TimeGenerated desc

-- Hunt for AD FS Configuration Access and Anomalous Processes
SELECT Process.Name AS ProcessName,
       Process.Pid,
       Process.Cmdline AS CommandLine,
       Process.Username,
       Process.Exe,
       Process.Ctime
FROM pslist()
WHERE Exe =~ "Microsoft.IdentityServer"
   OR Cmdline =~ "Import-Module.*Microsoft.IdentityServer"
   OR Username =~ ".*\\Adfs.*"

# Remediation and Hardening Script for CVE-2026-56155
# Requires Administrator Privileges

Write-Host "[+] Starting AD FS Security Assessment for CVE-2026-56155..." -ForegroundColor Cyan

# 1. Check if AD FS Role is installed
$adfsService = Get-Service -Name ADFS -ErrorAction SilentlyContinue

if ($null -eq $adfsService) {
    Write-Host "[-] AD FS Service not found on this host. Exiting." -ForegroundColor Yellow
    exit 0
} else {
    Write-Host "[+] AD FS Service detected (Status: $($adfsService.Status))." -ForegroundColor Green
}

# 2. Verify Patching Compliance (Generic Check - Update with specific KB from Vendor Advisory)
Write-Host "[+] Checking installed updates for recent security patches..."
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-60) }

if ($hotfixes) {
    Write-Host "[+] Recent patches found:" -ForegroundColor Green
    $hotfixes | Format-Table HotFixID, InstalledOn -AutoSize
} else {
    Write-Host "[!] No recent patches found in the last 60 days. Verify CVE-2026-56155 patch manually." -ForegroundColor Red
}

# 3. Audit AD FS Service Account Permissions
# Ensure the service account is not overly privileged (e.g., should not be a Domain Admin)
Write-Host "[+] Auditing AD FS Service Account..."
$adfsConfig = Get-WmiObject -Namespace root/ADFS -Class SecurityTokenServiceProperty -ErrorAction SilentlyContinue

if ($adfsConfig) {
    $serviceAccount = $adfsConfig.ServiceAccountName
    Write-Host "[+] AD FS Service Account: $serviceAccount" -ForegroundColor Cyan
    
    # Check group membership (Basic check)
    $groupMembership = (Get-ADPrincipalGroupMembership -Identity $serviceAccount).Name
    if ($groupMembership -contains "Domain Admins" -or $groupMembership -contains "Enterprise Admins") {
        Write-Host "[!] CRITICAL: AD FS Service Account is a member of a privileged group." -ForegroundColor Red
    } else {
        Write-Host "[+] Service account does not appear to be a Domain Admin." -ForegroundColor Green
    }
}

# 4. Enable Advanced Auditing for AD FS
Write-Host "[+] Ensuring Advanced Audit Policy is enabled for Logon/Privilege Use..."
auditpol /set /subcategory:"Logon" /success:enable /failure:enable | Out-Null
auditpol /set /subcategory:"Privilege Use" /success:enable /failure:enable | Out-Null
Write-Host "[+] Audit policies updated." -ForegroundColor Green

Write-Host "[+] Assessment complete. Please apply the specific security update for CVE-2026-56155 immediately." -ForegroundColor Cyan