Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
#authentication
3 articles
Detection Engineering
OAuth Misconfiguration: Defensive Review
An OAuth misconfiguration defensive review — redirect_uri validation, PKCE and state, detecting off-allowlist redirects and token anomalies, aligned to RFC 9700.
Detection Engineering
JWT Misconfiguration: Detection and Defense
JWT misconfiguration detection and defense — alg:none, RS256-to-HS256 confusion, and kid injection, with header-logging detection, Sigma rules, and MITRE mapping.