How to Detect AiTM Session Cookie Theft in Entra ID Sign In Logs
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
9 Nov 20269 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
2 posts found
How to Triage a Suspicious OAuth App Consent Alert in Entra ID
Work out what a user consented to, whether the app has touched any data and how to remove it safely, with KQL for Entra audit, sign in and Graph activity logs.
14 Jul 202610 min read