3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs
OAuth 2.0 is a widely used authorization framework that enables third-party applications to access user resources without exposing credentials. However, like any technology, it is susceptible to various threats. In this post, I’ll walk you through three OAuth Threat Tactics, Techniques, and Procedures (TTPs) that I’ve seen this month and how to detect them using Entra ID logs. What are TTPs in the context of OAuth? TTPs, or Threat Tactics, Techniques, and Procedures, are the methods attackers use to exploit OAuth vulnerabilities. Understanding these TTPs is crucial for implementing effective security measures and protecting your applications. ...