Hunting OAuth Token Theft: Detecting Modern Identity Attacks Before They Become Breaches

Identity has become one of the most targeted attack surfaces in modern enterprises. Instead of stealing passwords or deploying malware, attackers increasingly obtain valid OAuth access tokens and reuse them to move through SaaS applications and cloud environments. Unfortunately, many organizations lack the telemetry and detection logic needed to identify token abuse before it results in account compromise. This session demonstrates how defenders can hunt for OAuth token theft and replay using identity provider logs, API telemetry, cloud audit logs, and endpoint evidence. Through realistic attack scenarios—including token replay, bearer token theft, and OAuth redirect abuse—attendees will learn how to build hunting hypotheses, identify meaningful indicators, and create practical detections. The presentation includes example KQL and Sigma detections, recommended logging sources, ATT&CK mappings, and a reusable hunting playbook that attendees can adapt to Microsoft Entra ID, Okta, Google Workspace, and other identity platforms.