Skip to content
Threat Feed
Subscribe

Tag

Token_replay

1 brief RSS
medium advisory

Entra ID OAuth User Impersonation to Microsoft Graph

Detects potential session hijacking or token replay in Microsoft Entra ID, where a user signs in and subsequently accesses Microsoft Graph from a different IP address using the same session ID, indicating a successful OAuth phishing attack, session hijacking, or token replay attack.

Microsoft Entra ID +2 azure entra_id oauth graph_api token_replay session_hijacking initial_access defense_evasion
2r 2t