Token Analysis and Tracking System (TATS)
Summary
SpecterOps has released the Token Analysis and Tracking System (TATS), a tool designed to help track OAuth tokens. TATS collects, stores, decodes, analyzes, and visually tracks OAuth token exchanges, with initial development focused on Microsoft's ecosystem but applicable to any OAuth implementation.
IFF Assessment
FRIEND
The release of TATS is good for defenders as it provides a tool to better monitor and analyze potentially complex OAuth token exchanges, which can be a vector for compromise.
Defender Context
Understanding and monitoring token exchanges is crucial for detecting suspicious activity and potential abuse of authentication mechanisms. TATS offers a way to gain better visibility into OAuth token usage, which can be a blind spot for many security teams.