Onedrive Session Token Access

nomit vyas@xoxo

•updated Feb 8, 2026•0•57

Detects processes other than known Microsoft identity components accessing sensitive authentication token directories (IdentityCache or OneAuth). Threat actors use this technique to steal session tokens to bypass MFA and maintain persistent access to cloud environments.