Explore sessions and plan your time at RSAC™ 2026 Conference using the Full Agenda. Visit Create Your Schedule for details on favoriting vs. reserving a seat (when available), and how to secure your spot before the line closes 5 minutes prior to any session onsite.
 
See some amazing sessions you’d like to attend but need to upgrade your pass? Learn how.
Back to Session CatalogBack to Session Catalog
Chasing Ghosts: Detecting Token Abuse in the Microsoft Cloud - [HTA-W09]
  • Wednesday, Mar 252:25 PM - 3:15 PM PDT
    Moscone West 3001
    Reserved Seating
Attackers no longer need passwords to break in: tokens are the new prize. This session will expose how refresh tokens, access tokens, and Primary Refresh Tokens (PRTs) are stolen and abused in Microsoft Entra ID. Drawing on real-world cases, will show why detection feels like chasing ghosts and how to fight back.

Session Participant(s)

Type/Format: Track Session
Topic/Track: Identity, Hackers & Threats Advanced
Pass Requirement: All AccessCISO Boot CampCyber Leaders ForumeFG All AccessESAFMedia: Press/AnalystSpeaker
Session Classification: Advanced—Technical
Recording Status: Available On Demand