CrowdStrike breaks down 'Golden SAML' attack

A domain-joined model allows a single compromised administrator account to obtain ADFS keys and certificates that would also provide access to cloud services including Azure and Office 365.