Oauth Token Theft

Status: Scaffold — content in progress

ATT&CK: [Fill in technique ID]
Platforms: Azure / Entra ID
Severity: [Critical / High]

What It Exploits

[Technical primitive]

Attack Flow

[Step-by-step commands]

CTI Examples

[Real-world usage with evidence labels]

Behavioral Indicators

[Detection signals]

Cross-Links

Topic	Link
Detection	[Link to detection page]