3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

Published

2025-11-27 16:27

Collected

2026-08-29 01:08

---
id: 6941
title: "3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/recent-oauth-attacks-detection-strategies"
published_at: "2025-11-27T16:27:41Z"
tags: ["cloud", "identity-security", "entra-id", "azure", "detection", "oauth", "ttps", "kql"]
phying_url: "https://phying.com/item/6941"
lang: en
---

# 3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

## Summary

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-11-27T16:27:41Z
- **Original:** https://www.wiz.io/blog/recent-oauth-attacks-detection-strategies
- **Phying News:** https://phying.com/item/6941