Tycoon Phishing Kit OAuth Application Impersonation
Detects indicators of compromise (IOCs) and suspicious OAuth consent activity linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
Sigma
