medium10 pts · first answer countsidentity-securityentra-idlogging
Where token reuse shows up
You suspect an attacker is reusing a stolen refresh token. The interactive sign-in logs for the user look clean. Where should you look next?
Discussion 0
Join free to post in the discussion.
Related questions
- Which login is really two-factor?Cybersecurity Analyst
- Why passwords are saltedCybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- Entra sign-in logs vs audit logsCybersecurity Analyst
- Authentication or authorization?Cybersecurity Analyst
- What a Kerberos TGT is forCybersecurity Analyst
- Where the Kerberos KDC runsCybersecurity Analyst
- Windows event for a failed logonCybersecurity Analyst