OAuth Sign-in from Residential Proxy with Successful Logon

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•4

This rule detects successful OAuth sign-ins originating from a residential proxy IP address, correlated with a successful identity logon event for the same user. This pattern can indicate an adversary using residential proxies to bypass geo-restrictions or blend in with legitimate user traffic while attempting to access accounts via OAuth.