AzTokenFinder.exe --help

   --mode                 Required. (Default: Online) Use mode 'online' for parsing processes or use mode offline to decode TokenBroker Cache

  --filename             Set path to a BrokerCache File.

  --processname          Names of process you want to parse. Please omit the ".exe".

  --processids           ProcessIDs you want to parse.

  --default              Enumerate Edge, Excel, Word, PowerShell, Teams, Onedrive and PowerPoint.

  --showexpiredtokens    (Default: false) Shows expired tokens.

  --targetapp            (Default: false) Parses the files where Office, Azure CLI or Azure PowerShell stores its data. Can be Office
                         (TokenCache), AZCLI (Azure CLI) or AzPWSH (Azure Powershell)

  --help                 Display this help screen.

  --version              Display version information.