REVOKING THE TOKEN DIDN'T KILL THE BACKDOOR

Summary from the TLDR IT newsletter

Traditional incident response steps like revoking OAuth tokens fail when an implant can dynamically replace its entire credential set and OneDrive command-and-control identity via a single remote task. Investigators should treat application registrations as the durable object of compromise rather than relying solely on token revocation, and hunt on the identity plane using cloud telemetry.