Anomalous OIDC/external auth token use post-Coder registry compromise

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects non-interactive sign-in events involving OIDC or external authentication tokens shortly after a known Coder registry compromise. The rule flags high-risk or at-risk single-factor authentication sessions, which may indicate the replay of stolen tokens harvested during the compromise window.