What SIEM detections catch token theft from desktop chat apps after the latest link-scanning rollout?

To detect token theft from desktop chat apps after the link-scanning rollout, configure your SIEM for:

• Unusual API calls: Alerts on chat API access from new or foreign IPs using valid tokens.
• Process-to-network anomalies: Watch for non-chat binaries reading token cache files or hitting chat domains.
• Token reuse patterns: Detect the same auth token used across multiple devices or geographies.
• File I/O telemetry: Flag unauthorized reads of %AppData%/…/Local Storage or credential vault files.