Weak JWT secret brute-force via jwt_tool leading to forged token success
Detects a sequence of failed authentication attempts potentially indicative of an offline JWT secret brute-force attack (using tools like jwt_tool), followed by a successful authentication from the same source. This pattern suggests the adversary successfully recovered the secret, forged a valid token, and subsequently used it to gain unauthorized access.
Microsoft Sentinel (KQL)
