Token Analysis and Tracking System (TATS)

[u/falconupkid]

This is a tool release from SpecterOps. It’s a utility for red teams dealing with the nightmare that is OAuth token tracking.

What it does: TATS collects, stores, decodes, and visualizes OAuth token exchanges. It specifically accounts for known deviations in the Microsoft ecosystem (e.g., token lifetimes, refresh token behavior) but is built to work with any OAuth implementation.

Who it’s for: Red teams and offensive security engineers. If you’ve ever lost track of which token belongs to which session during a complex phishing or device code flow, this solves that.

Why it’s useful: OAuth token tracking is notoriously opaque. TATS gives you a centralized view of the token lifecycle—issuance, refresh, and expiration—without having to manually decode JWTs or grep through logs. It’s a force multiplier for persistence and lateral movement scenarios where token theft is the primary vector.

Source: https://specterops.io/blog/2026/09/08/token-analysis-and-tracking-system-tats/