Recent breaches, such as those related to the SolarWinds supply chain attack, have focused attention on the considerable challenges that organizations face re-establishing trust in a network where an adversary may have maintained privileged access on it for some time. In several of the breaches, attackers stole the victim organization’s Active Directory Federation Services (ADFS) token-signing certificate and used it to forge SAML tokens for arbitrary users.

Read full article on Dark Reading