Detection Script
For complete attack details, detection indicators, and mitigation strategies, see the Golden SAML (Attack #13) section in the Five Eyes AD Attacks guide.
Golden SAML Detection Script
Detect forged SAML tokens for cloud access via compromised ADFS.