Post-exposure OIDC/API token use from unfamiliar IP after Coder compromise

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•2

This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.