ATT&CK technique
View on MITRE ATT&CK →
T1656
Impersonation
Stealth
deprecated
1 detection found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Entra ID OAuth user_impersonation Scope for Unusual User and Client | production | 2026-09-18 |