Most Significant ShinyHunters 2026: Third-Party Connected App OAuth Token Abuse Following Vendor Supply-Chain Compromise
Monitors SaaS application integration service accounts (e.g., Salesforce connected apps) by establishing baselines for API call volume and accessed object types. The rule alerts on anomalous spikes in usage or deviations in the scope of accessed data objects, which could indicate the abuse of compromised OAuth tokens following a vendor supply-chain compromise.
Microsoft Sentinel (KQL)
