Detect authentication protocol abuse across OAuth2/OIDC and SAML IdPs.
npx skills add https://github.com/OpenTideHQ/AgentTide --skill identity-providers
Please help me install this Agent Skill. Skill: identity-providers Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/identity-providers Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill identity-providers
The skill decodes and standardizes modern authentication protocol behavior to empower detection engineers to identify abusive patterns across diverse IdPs in a vendor-neutral way.
Describe a detection scenario involving Golden SAML and outline the signals to monitor.
High-intent search queries and answers about installing and using this skill.
To detect Golden SAML attacks across identity providers, you monitor SAML assertion behavior and federation trust chains for anomalous token signing patterns. The Skill provides vendor-neutral guidance and practical examples for identifying these abusive authentication flows.
Detecting OAuth2 token theft and refresh token abuse involves analyzing authorization code flows, device code grants, and refresh token mechanics. The Skill standardizes modern authentication protocol behavior to identify these abusive patterns across diverse IdPs.
Yes, you can monitor MFA bypass attempts in Entra ID, Okta, and ADFS. The Skill applies cross-vendor coverage to analyze MFA ceremonies and policy-based access evaluations, helping identify conditional access misconfigurations.
Device code flow detection works by analyzing OAuth2 grant types and token issuance patterns for unauthorized access. The Skill decodes protocol behavior across IdPs to identify when device code authentication is abused for token theft.
Detecting PRT misuse and conditional access misconfigurations requires authentication logs containing OAuth2 flows, SAML assertions, and policy evaluation data. The Skill provides the analytical framework to interpret these signals across different identity provider environments.
uphiagoTest Okta identity provider security with red-team attack techniques.
bpnrockstarDetect and validate 7 MFA/2FA bypass patterns in authentication flows.
aviskaarConduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.
Yona544Automates Microsoft 365 tenant setup, administration, and governance workflows.
