Add 5 new cybersecurity skills batch 2 - oauth token theft, binary exploitation, STIX2 sharing, linux audit logs, timestomping detection

skills/detecting-oauth-token-theft/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: detecting-oauth-token-theft
+description: >
+  Detect OAuth access token theft and misuse by analyzing sign-in logs for
+  impossible travel, new device patterns, token replay from unusual IPs,
+  and anomalous scope requests via Microsoft Graph and Okta APIs.
+domain: cybersecurity
+subdomain: identity-security
+tags: [oauth, token-theft, identity-attacks, impossible-travel]
+version: "1.0"
+author: mahipal
+license: Apache-2.0
+---
+
+# Detecting OAuth Token Theft
+
+Analyze OAuth sign-in telemetry for indicators of token theft including
+impossible travel, device fingerprint changes, and token replay attacks.