PowerShell Execution of Invoke-ClientIdSpoofEnum ROPC Enumeration Tool

Duo Tech@duotech

•updated Jul 14, 2026•0•0•4

Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.