'Tis the season for ghosts—and in the Microsoft cloud, the scariest ones are the ones you never see coming. Stolen and forged tokens let attackers move through your environment while looking like legitimate users, making token abuse one of the hardest threats to catch after the fact.

In this Top-Rated Follow Up, Maxim Deweerdt, Principal Instructor at SANS, builds on his RSA Conference 2026 session to cover new developments in how attackers steal, replay, and abuse tokens across the Microsoft cloud—and what defenders can do about it. You'll leave with sharper techniques for spotting the "ghosts" in your environment: anomalous sign-ins, token replays, and privilege escalations that slip past standard monitoring. Whether you caught the original talk or you're starting here, walk away with practical ways to strengthen token abuse detection in the Microsoft cloud.

The first portion of this session will be recorded and available afterward. We'll close with a live Q&A held under Chatham House Rule (not recorded), giving attendees space for candid, off-the-record discussion.