I Want The Log I Can’t Have

I was fascinated when I read during the Solorigate attack that an adversary utilized Golden SAML to gain access to Azure and Office 365 cloud resources. At the time, I was developing an adversary emulation for a blue team capture the flag event and I decided I should make this a key pillar of the emulation so others could experience it. If you’re like me, you have spent some portion of your career working with events generated from on-premise systems. …

access adversary adversary emulation attack azure blue blue team capture cloud cloud resources emulation event flag golden key log office office 365 resources saml team