ADFSDump

ADFSDump is a tool used in post-exploitation against Active Directory Federation Services (AD FS) environments to extract certificates needed for Golden SAML abuse. The provided content specifically identifies it as one of several tools that can help an adversary extract the token-signing material required to forge SAML assertions, alongside certutil.exe, PowerShell, and Mimikatz. It is noted that ADFSDump must be executed under the user context of the AD FS service account. In the described attack chain, theft of the AD FS token-signing certificate/private key enables Golden SAML operations, allowing adversaries to forge SAML responses, impersonate arbitrary users, escalate privileges, and bypass MFA because the legitimate identity provider is removed from the authentication flow. The content ties this broader technique to high-profile activity such as the SolarWinds Orion compromise, but does not directly attribute ADFSDump itself to a specific threat actor. The relevant target environment is Windows infrastructure using AD FS for federated SSO. Detection guidance in the supporting content focuses on certificate export and related activity in AD FS environments, including ADFS Admin events 1200, 1202, 307, and 510; certificate export event 1007; Security event 4688 with command-line logging; PowerShell events 4103 and 4104; Domain Controller event 4769; and Sysmon event 18 for named pipe activity.