detecting-oauth-token-theft

name	detecting-oauth-token-theft
description	Detect OAuth access token theft and misuse by analyzing sign-in logs for impossible travel, new device patterns, token replay from unusual IPs, and anomalous scope requests via Microsoft Graph and Okta APIs.
domain	cybersecurity
subdomain	identity-security
tags	["oauth","token-theft","identity-attacks","impossible-travel"]
version	1.0
author	mahipal
license	Apache-2.0

Detecting OAuth Token Theft

Analyze OAuth sign-in telemetry for indicators of token theft including impossible travel, device fingerprint changes, and token replay attacks.