Field Analysis
OAuth Client-ID Spoofing Turns App Identity Into Enumeration Noise
Two large Entra ID campaigns used hundreds of thousands to millions of fictional OAuth client IDs to spread account enumeration across apparent applications.
Tag
#Entra ID
3 articles covering Entra ID across campaign analysis, detection engineering, and defender tradecraft.
Coverage
3 entriesField Analysis
Device Code Phishing: A Walkthrough and Detection Playbook
Device code phishing turns a legitimate OAuth flow into a credential-free token theft technique. Here is how it runs end-to-end and what defenders can hunt on in Sentinel and Defender XDR.
Read more:Microsoft Security BlogIETF
Field Analysis
From User Report to Token Revocation: A 60-Minute M365 Phishing Response Walkthrough
Most M365 phishing incidents are decided in the first hour. This walkthrough lays out a 60-minute response chain from user report to refresh-token revocation and consent reversal.