Dissecting the Golden SAML Attack Used by Attackers Exploiting the SUNBURST Backdoor

3/4/2021 12:00:00 PM [(UTC-05:00) Eastern Time (US & Canada)] - Can't make the live event? Register anyway to receive a link to the recording.

Show/Hide All Time Zones

All Time Zones

Dateline Standard Time-(UTC-12:00) International Date Line West 3/4/2021 5:00:00 AM
UTC-11-(UTC-11:00) Coordinated Universal Time-11 3/4/2021 6:00:00 AM
Aleutian Standard Time-(UTC-10:00) Aleutian Islands 3/4/2021 7:00:00 AM
Hawaiian Standard Time-(UTC-10:00) Hawaii 3/4/2021 7:00:00 AM
Marquesas Standard Time-(UTC-09:30) Marquesas Islands 3/4/2021 7:30:00 AM
Alaskan Standard Time-(UTC-09:00) Alaska 3/4/2021 8:00:00 AM
UTC-09-(UTC-09:00) Coordinated Universal Time-09 3/4/2021 8:00:00 AM
Pacific Standard Time (Mexico)-(UTC-08:00) Baja California 3/4/2021 9:00:00 AM
UTC-08-(UTC-08:00) Coordinated Universal Time-08 3/4/2021 9:00:00 AM
Pacific Standard Time-(UTC-08:00) Pacific Time (US & Canada) 3/4/2021 9:00:00 AM
US Mountain Standard Time-(UTC-07:00) Arizona 3/4/2021 10:00:00 AM
Mountain Standard Time (Mexico)-(UTC-07:00) Chihuahua, La Paz, Mazatlan 3/4/2021 10:00:00 AM
Mountain Standard Time-(UTC-07:00) Mountain Time (US & Canada) 3/4/2021 10:00:00 AM
Yukon Standard Time-(UTC-07:00) Yukon 3/4/2021 10:00:00 AM
Central America Standard Time-(UTC-06:00) Central America 3/4/2021 11:00:00 AM
Central Standard Time-(UTC-06:00) Central Time (US & Canada) 3/4/2021 11:00:00 AM
Easter Island Standard Time-(UTC-06:00) Easter Island 3/4/2021 12:00:00 PM
Central Standard Time (Mexico)-(UTC-06:00) Guadalajara, Mexico City, Monterrey 3/4/2021 11:00:00 AM
Canada Central Standard Time-(UTC-06:00) Saskatchewan 3/4/2021 11:00:00 AM
SA Pacific Standard Time-(UTC-05:00) Bogota, Lima, Quito, Rio Branco 3/4/2021 12:00:00 PM
Eastern Standard Time (Mexico)-(UTC-05:00) Chetumal 3/4/2021 12:00:00 PM
Eastern Standard Time-(UTC-05:00) Eastern Time (US & Canada) 3/4/2021 12:00:00 PM
Haiti Standard Time-(UTC-05:00) Haiti 3/4/2021 12:00:00 PM
Cuba Standard Time-(UTC-05:00) Havana 3/4/2021 12:00:00 PM
US Eastern Standard Time-(UTC-05:00) Indiana (East) 3/4/2021 12:00:00 PM
Turks And Caicos Standard Time-(UTC-05:00) Turks and Caicos 3/4/2021 12:00:00 PM
Paraguay Standard Time-(UTC-04:00) Asuncion 3/4/2021 2:00:00 PM
Atlantic Standard Time-(UTC-04:00) Atlantic Time (Canada) 3/4/2021 1:00:00 PM
Venezuela Standard Time-(UTC-04:00) Caracas 3/4/2021 1:00:00 PM
Central Brazilian Standard Time-(UTC-04:00) Cuiaba 3/4/2021 1:00:00 PM
SA Western Standard Time-(UTC-04:00) Georgetown, La Paz, Manaus, San Juan 3/4/2021 1:00:00 PM
Pacific SA Standard Time-(UTC-04:00) Santiago 3/4/2021 2:00:00 PM
Newfoundland Standard Time-(UTC-03:30) Newfoundland 3/4/2021 1:30:00 PM
Tocantins Standard Time-(UTC-03:00) Araguaina 3/4/2021 2:00:00 PM
E. South America Standard Time-(UTC-03:00) Brasilia 3/4/2021 2:00:00 PM
SA Eastern Standard Time-(UTC-03:00) Cayenne, Fortaleza 3/4/2021 2:00:00 PM
Argentina Standard Time-(UTC-03:00) City of Buenos Aires 3/4/2021 2:00:00 PM
Greenland Standard Time-(UTC-03:00) Greenland 3/4/2021 2:00:00 PM
Montevideo Standard Time-(UTC-03:00) Montevideo 3/4/2021 2:00:00 PM
Magallanes Standard Time-(UTC-03:00) Punta Arenas 3/4/2021 2:00:00 PM
Saint Pierre Standard Time-(UTC-03:00) Saint Pierre and Miquelon 3/4/2021 2:00:00 PM
Bahia Standard Time-(UTC-03:00) Salvador 3/4/2021 2:00:00 PM
UTC-02-(UTC-02:00) Coordinated Universal Time-02 3/4/2021 3:00:00 PM
Mid-Atlantic Standard Time-(UTC-02:00) Mid-Atlantic - Old 3/4/2021 3:00:00 PM
Azores Standard Time-(UTC-01:00) Azores 3/4/2021 4:00:00 PM
Cape Verde Standard Time-(UTC-01:00) Cabo Verde Is. 3/4/2021 4:00:00 PM
UTC-(UTC) Coordinated Universal Time 3/4/2021 5:00:00 PM
GMT Standard Time-(UTC+00:00) Dublin, Edinburgh, Lisbon, London 3/4/2021 5:00:00 PM
Greenwich Standard Time-(UTC+00:00) Monrovia, Reykjavik 3/4/2021 5:00:00 PM
Sao Tome Standard Time-(UTC+00:00) Sao Tome 3/4/2021 5:00:00 PM
Morocco Standard Time-(UTC+01:00) Casablanca 3/4/2021 6:00:00 PM
W. Europe Standard Time-(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna 3/4/2021 6:00:00 PM
Central Europe Standard Time-(UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague 3/4/2021 6:00:00 PM
Romance Standard Time-(UTC+01:00) Brussels, Copenhagen, Madrid, Paris 3/4/2021 6:00:00 PM
Central European Standard Time-(UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb 3/4/2021 6:00:00 PM
W. Central Africa Standard Time-(UTC+01:00) West Central Africa 3/4/2021 6:00:00 PM
Jordan Standard Time-(UTC+02:00) Amman 3/4/2021 7:00:00 PM
GTB Standard Time-(UTC+02:00) Athens, Bucharest 3/4/2021 7:00:00 PM
Middle East Standard Time-(UTC+02:00) Beirut 3/4/2021 7:00:00 PM
Egypt Standard Time-(UTC+02:00) Cairo 3/4/2021 7:00:00 PM
E. Europe Standard Time-(UTC+02:00) Chisinau 3/4/2021 7:00:00 PM
Syria Standard Time-(UTC+02:00) Damascus 3/4/2021 7:00:00 PM
West Bank Standard Time-(UTC+02:00) Gaza, Hebron 3/4/2021 7:00:00 PM
South Africa Standard Time-(UTC+02:00) Harare, Pretoria 3/4/2021 7:00:00 PM
FLE Standard Time-(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius 3/4/2021 7:00:00 PM
Israel Standard Time-(UTC+02:00) Jerusalem 3/4/2021 7:00:00 PM
Kaliningrad Standard Time-(UTC+02:00) Kaliningrad 3/4/2021 7:00:00 PM
Sudan Standard Time-(UTC+02:00) Khartoum 3/4/2021 7:00:00 PM
Libya Standard Time-(UTC+02:00) Tripoli 3/4/2021 7:00:00 PM
Namibia Standard Time-(UTC+02:00) Windhoek 3/4/2021 7:00:00 PM
Arabic Standard Time-(UTC+03:00) Baghdad 3/4/2021 8:00:00 PM
Turkey Standard Time-(UTC+03:00) Istanbul 3/4/2021 8:00:00 PM
Arab Standard Time-(UTC+03:00) Kuwait, Riyadh 3/4/2021 8:00:00 PM
Belarus Standard Time-(UTC+03:00) Minsk 3/4/2021 8:00:00 PM
Russian Standard Time-(UTC+03:00) Moscow, St. Petersburg 3/4/2021 8:00:00 PM
E. Africa Standard Time-(UTC+03:00) Nairobi 3/4/2021 8:00:00 PM
Iran Standard Time-(UTC+03:30) Tehran 3/4/2021 8:30:00 PM
Arabian Standard Time-(UTC+04:00) Abu Dhabi, Muscat 3/4/2021 9:00:00 PM
Astrakhan Standard Time-(UTC+04:00) Astrakhan, Ulyanovsk 3/4/2021 9:00:00 PM
Azerbaijan Standard Time-(UTC+04:00) Baku 3/4/2021 9:00:00 PM
Russia Time Zone 3-(UTC+04:00) Izhevsk, Samara 3/4/2021 9:00:00 PM
Mauritius Standard Time-(UTC+04:00) Port Louis 3/4/2021 9:00:00 PM
Saratov Standard Time-(UTC+04:00) Saratov 3/4/2021 9:00:00 PM
Georgian Standard Time-(UTC+04:00) Tbilisi 3/4/2021 9:00:00 PM
Volgograd Standard Time-(UTC+04:00) Volgograd 3/4/2021 9:00:00 PM
Caucasus Standard Time-(UTC+04:00) Yerevan 3/4/2021 9:00:00 PM
Afghanistan Standard Time-(UTC+04:30) Kabul 3/4/2021 9:30:00 PM
West Asia Standard Time-(UTC+05:00) Ashgabat, Tashkent 3/4/2021 10:00:00 PM
Ekaterinburg Standard Time-(UTC+05:00) Ekaterinburg 3/4/2021 10:00:00 PM
Pakistan Standard Time-(UTC+05:00) Islamabad, Karachi 3/4/2021 10:00:00 PM
Qyzylorda Standard Time-(UTC+05:00) Qyzylorda 3/4/2021 10:00:00 PM
India Standard Time-(UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi 3/4/2021 10:30:00 PM
Sri Lanka Standard Time-(UTC+05:30) Sri Jayawardenepura 3/4/2021 10:30:00 PM
Nepal Standard Time-(UTC+05:45) Kathmandu 3/4/2021 10:45:00 PM
Central Asia Standard Time-(UTC+06:00) Astana 3/4/2021 11:00:00 PM
Bangladesh Standard Time-(UTC+06:00) Dhaka 3/4/2021 11:00:00 PM
Omsk Standard Time-(UTC+06:00) Omsk 3/4/2021 11:00:00 PM
Myanmar Standard Time-(UTC+06:30) Yangon (Rangoon) 3/4/2021 11:30:00 PM
SE Asia Standard Time-(UTC+07:00) Bangkok, Hanoi, Jakarta 3/5/2021 12:00:00 AM
Altai Standard Time-(UTC+07:00) Barnaul, Gorno-Altaysk 3/5/2021 12:00:00 AM
W. Mongolia Standard Time-(UTC+07:00) Hovd 3/5/2021 12:00:00 AM
North Asia Standard Time-(UTC+07:00) Krasnoyarsk 3/5/2021 12:00:00 AM
N. Central Asia Standard Time-(UTC+07:00) Novosibirsk 3/5/2021 12:00:00 AM
Tomsk Standard Time-(UTC+07:00) Tomsk 3/5/2021 12:00:00 AM
China Standard Time-(UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi 3/5/2021 1:00:00 AM
North Asia East Standard Time-(UTC+08:00) Irkutsk 3/5/2021 1:00:00 AM
Singapore Standard Time-(UTC+08:00) Kuala Lumpur, Singapore 3/5/2021 1:00:00 AM
W. Australia Standard Time-(UTC+08:00) Perth 3/5/2021 1:00:00 AM
Taipei Standard Time-(UTC+08:00) Taipei 3/5/2021 1:00:00 AM
Ulaanbaatar Standard Time-(UTC+08:00) Ulaanbaatar 3/5/2021 1:00:00 AM
Aus Central W. Standard Time-(UTC+08:45) Eucla 3/5/2021 1:45:00 AM
Transbaikal Standard Time-(UTC+09:00) Chita 3/5/2021 2:00:00 AM
Tokyo Standard Time-(UTC+09:00) Osaka, Sapporo, Tokyo 3/5/2021 2:00:00 AM
North Korea Standard Time-(UTC+09:00) Pyongyang 3/5/2021 2:00:00 AM
Korea Standard Time-(UTC+09:00) Seoul 3/5/2021 2:00:00 AM
Yakutsk Standard Time-(UTC+09:00) Yakutsk 3/5/2021 2:00:00 AM
Cen. Australia Standard Time-(UTC+09:30) Adelaide 3/5/2021 3:30:00 AM
AUS Central Standard Time-(UTC+09:30) Darwin 3/5/2021 2:30:00 AM
E. Australia Standard Time-(UTC+10:00) Brisbane 3/5/2021 3:00:00 AM
AUS Eastern Standard Time-(UTC+10:00) Canberra, Melbourne, Sydney 3/5/2021 4:00:00 AM
West Pacific Standard Time-(UTC+10:00) Guam, Port Moresby 3/5/2021 3:00:00 AM
Tasmania Standard Time-(UTC+10:00) Hobart 3/5/2021 4:00:00 AM
Vladivostok Standard Time-(UTC+10:00) Vladivostok 3/5/2021 3:00:00 AM
Lord Howe Standard Time-(UTC+10:30) Lord Howe Island 3/5/2021 4:00:00 AM
Bougainville Standard Time-(UTC+11:00) Bougainville Island 3/5/2021 4:00:00 AM
Russia Time Zone 10-(UTC+11:00) Chokurdakh 3/5/2021 4:00:00 AM
Magadan Standard Time-(UTC+11:00) Magadan 3/5/2021 4:00:00 AM
Norfolk Standard Time-(UTC+11:00) Norfolk Island 3/5/2021 5:00:00 AM
Sakhalin Standard Time-(UTC+11:00) Sakhalin 3/5/2021 4:00:00 AM
Central Pacific Standard Time-(UTC+11:00) Solomon Is., New Caledonia 3/5/2021 4:00:00 AM
Russia Time Zone 11-(UTC+12:00) Anadyr, Petropavlovsk-Kamchatsky 3/5/2021 5:00:00 AM
New Zealand Standard Time-(UTC+12:00) Auckland, Wellington 3/5/2021 6:00:00 AM
UTC+12-(UTC+12:00) Coordinated Universal Time+12 3/5/2021 5:00:00 AM
Fiji Standard Time-(UTC+12:00) Fiji 3/5/2021 5:00:00 AM
Kamchatka Standard Time-(UTC+12:00) Petropavlovsk-Kamchatsky - Old 3/5/2021 5:00:00 AM
Chatham Islands Standard Time-(UTC+12:45) Chatham Islands 3/5/2021 6:45:00 AM
UTC+13-(UTC+13:00) Coordinated Universal Time+13 3/5/2021 6:00:00 AM
Tonga Standard Time-(UTC+13:00) Nuku'alofa 3/5/2021 6:00:00 AM
Samoa Standard Time-(UTC+13:00) Samoa 3/5/2021 7:00:00 AM
Line Islands Standard Time-(UTC+14:00) Kiritimati Island 3/5/2021 7:00:00 AM

Webinar Registration

The SUNBURST backdoor inserted into SolarWinds constitutes the worst ever supply chain attack, but it was just the beginning for organizations actually targeted via SUNBURST. In my webinar on that attack, we pointed out that it gave attackers access to Orion systems on victim networks, that by virtue of being a trusted monitoring platform, it has privileged access throughout most environments where it’s deployed.

Once you gain control of a system like Orion, you basically have a ticket to ride. And ride they did. Many victims experienced a compromise of their Office 365 email accounts. How did attackers get from Orion — usually running on the on-prem network — to the Microsoft cloud?

They did it via the Golden SAML attack.

The standard ways for organizations to get single identity between Office 365 and on-prem AD is either:

  • Synchronization: Azure AD Connect runs on an on-prem service and projects a copy of users and groups in your on-prem AD into Azure AD.
  • Federation: Instead of maintaining a copy of users and groups in Azure AD, you set up your Office 365 tenant to rely on your ADFS server to authenticate logons to Office 365 against your on-prem AD on the fly. ADFS employs tokens expressed in Security Assertion Markup Language (SAML).

Golden SAML is an attack against the latter in which the attacker steals the private key of your ADFS server and uses it to forge a SAML token that for all intents and purposes looks like a legit token issued by your ADFS server. Office 365 trusts it and allows the attack to access any Office 365 resource available to the impersonated user — including their mailbox.

In this webinar, I will briefly introduce you to federation and SAML and how it works in Office 365. And I will discuss how attackers exploited selected installations of the SUNBURST backdoor to laterally move to the victim organization’s ADFS server and stole its private key.

Then, joined by the very knowledgeable security researchers Sally Vincent and Dan Kaiser from LogRhythm Labs, we will show you:

  • How a Golden SAML attack works
  • Possible ways to mitigate via preventive controls
  • Methods for detection via SIEM rules and threat hunting
  • What Office 365 logs do and don’t tell us about federated logins

You will see an actual demonstration of an attack by Sally, and we’ll cover the actual event IDs you need to monitor and attempt to correlate from:

  • Domain controllers
  • ADFS servers
  • Office 365 audit log

This will be a highly technical session I think you will really enjoy and benefit from. Especially because we expect to see a lot more Golden SAML attacks this year.

LogRhythm is our sponsor for this real training for free event and you’ll briefly see how their awesome technology combined with their expert research and knowledge engineering gives you a leg up in today’s ever changing threat landscape.

Please join us for this real training for free session.

First Name:   
Last Name:   
Work Email:  
Job Title:

Your information will be shared with the sponsor.

By clicking "Submit", you're agreeing to our Privacy Policy and consenting to be contacted by us.



Additional Resources