Product
Attackers may delete Azure AD Hybrid Health AD FS service instances to conceal the removal of fake servers used for spoofing AD FS signing logs.