Large-Scale Multi-Tenant OAuth Client ID Spoofing Enumeration
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Sigma
