With more and more organizations moving to the cloud, specifically Azure Active Directory/Microsoft 365 (formerly Office 365), Trimarc...

the attacker could compromise the Azure AD Domain Services domain and persist at the Domain Controller and/or domain level