defensive-oauth

What problem does it solve?

Detect OAuth abuse in identity ecosystems, including consent phishing, AiTM proxy session hijacking, redirect URI manipulation, and CSRF-related risks, to protect users and data.

Core Features & Use Cases

• Consent phishing detection identify suspicious consent grants and risky app permissions in Entra ID.
• AiTM/session hijack detection correlate MFA and session IPs to catch anomalous logins.
• Redirect URI abuse monitor for OAuth redirects to untrusted domains and misconfigurations.
• Threat remediation guidance provide actionable response steps and hardening recommendations for SOC.

Quick Start

Activate this skill to start detecting OAuth threats in your identity environment and triage alerts effectively.