MEET SILVER SAML: GOLDEN SAML IN THE CLOUD

Summary from the TLDR InfoSec newsletter

Golden SAML is a post-exploitation attack technique that involves extracting signing certificates from Active Directory Federation Services to forge signing certificates. In the wake of the Solar Winds attack, organizations were urged to move to a cloud-based SAML like Entra ID to prevent Golden SAML attacks. This post presents a new attack method that leverages externally generated SAML certificates to forge authentication responses from an Entra ID SAML server.