Browse Rules

[CISCO-SCA] Azure OAuth Bypass

[CISCO-SCA] Azure OAuth Bypass

Ping Federate - OAuth old version

'Detects requests using not the latest version of OAuth protocol.'

[GCP] Google Identity Oauth2 Deny event detected [10/5]

[GCP] Google Identity Oauth2 Deny event detected [10/5]

Salesforce OAuth Credential Abuse Detection

Detects OAuth credential abuse and suspicious token usage patterns in Salesforce. OAuth tokens provide API access and can be abused if compromised, making this detection critical for: - Stolen or leaked OAuth tokens - Token replay attacks - Excessive API usage indicating automated abuse - Failed token refresh attempts (potential brute force) - Unauthorized token revocations This detection triggers on OAuth-related security events and adjusts severity based on: - Token revocation events (may ind

[BOX] An OAuth 2.0 access token has been revoked

[BOX] An OAuth 2.0 access token has been revoked

beta.DLP: OAuth Client Secret

Detects messages containing OAuth client secrets.

Azure VS Code OAuth Phishing

Detects OAuth authorization flows where Visual Studio Code successfully authenticates to Microsoft Graph. While legitimate for developers, this pattern is commonly abused in phishing campaigns where attackers use the trusted VS Code client ID to trick users into granting OAuth tokens.

[Entra ID] Suspicious Continuous OAuth Token Usage

Detects repeated use of the same OAuth token across different IPs or locations over time. This can indicate token theft or session abuse.

M365 Identity OAuth Flow by User Sign-in to Device Registration

Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources.

Tailscale: New API access token or OAuth client created

Identifies when a new API access token or OAuth client is created in the tailnet. These grant programmatic access - verify the actor and intent.

Salesforce Third-Party Integration Monitoring

Monitors third-party integrations and OAuth connected apps accessing Salesforce. Connected apps use OAuth for authorization and can access data on behalf of users, making them a potential vector for: - Unauthorized data access - Shadow IT applications - Compromised OAuth tokens - Over-privileged integrations This detection triggers on connected app usage events and adjusts severity based on: - Connection type (refresh tokens are higher risk) - App authorization events - Suspicious app naming pa

Google Workspace OAuth Token Requests from New IP

Alerts when users request OAuth tokens from IP addresses they haven't used in the past 30 days, with 3+ requests indicating active usage. This may indicate GAIA credential theft where attackers use stolen refresh tokens to request access tokens from their infrastructure.

Google Workspace OAuth Application Authorized with Privileged Scopes

Detects when a user authorizes an OAuth application with privileged scopes in Google Workspace. Privileged scopes grant broad access to sensitive data and administrative functions.

Tailscale: OAuth client or API key created with write scopes

Identifies creation of a Tailscale OAuth client or API access key whose granted scopes include WRITE permissions (anything matching :write). Tokens with write scopes are high-value adversary targets.

Windows Credential Dumping Tool

Detects execution of tools commonly used for credential dumping on Windows systems. These tools can extract OAuth refresh tokens (GAIA), passwords, and authentication secrets from Windows memory (LSASS) and registry.

O365 OAuth App Mailbox Access via EWS

The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confir

GitHub OAuth Application Access Restrictions Disabled

Detects when third-party application access restrictions are disabled for a GitHub organization.

First Time Seen Google Workspace OAuth Login from Third-Party Application

Detects the first time a user authorizes a third-party Google OAuth application that requests identity or sign-in scopes. Adversaries may abuse compromised credentials or phishing-linked consent flows to register novel OAuth clients, obtain refresh tokens, and authenticate as valid users while evading password-only detections.

O365 User Consent Denied for OAuth Application

The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Office 365 environment. This detection leverages O365 audit logs, focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, it captures instances where users have actively rejected permission requests. This activity is significant as it may indicate users spotting potentially suspicious or unfamili

OAuth Access Token Granted for Public Client App from Multiple Client Addresses

This hunting query identifies when a public client app successfully retrieves an OAuth access token using client credentials from multiple client addresses. For public client applications in Okta that leverage OAuth, client credentials can be used to retrieve access tokens without user consent. Unsecured credentials may be compromised by an adversary who may use them to request an access token on behalf of the public client app.

Service abuse: Google OAuth with suspicious redirect destination

Detects messages containing Google OAuth links with prompt=none parameter that redirect to suspicious domains including free file hosts, free subdomain providers, or self-service creation platforms.

Suspicious Office 365 app authorization (OAuth) link

Message contains a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account.

Rare Occurrence of OAuth Access Token Granted to Public Client App

This hunting query identifies a rare occurrence of a public client app successfully retrieves an OAuth access token using client credentials as the grant type within the last 14 days. Public client applications in Okta that leverage OAuth, client credentials can be used to retrieve access tokens without user consent. Unsecured credentials may be compromised by an adversary whom may use them to request an access token on behalf of the public client app.

Google Workspace Device Registration After OAuth from Suspicious ASN

Detects when a Google Workspace account completes OAuth authorization for a specific Google OAuth client from a high-risk autonomous system number (ASN), followed within 30 seconds by a device registration event with account state REGISTERED. This sequence can indicate device enrollment or join flows initiated from attacker-controlled or residential-proxy infrastructure after a user authorizes a sensitive client.

Entra ID OAuth Application Redirect URI Modified

Identifies modifications to OAuth application redirect URIs (ReplyUrls) in Entra ID. Adding an attacker-controlled redirect URI to an existing trusted application allows interception of OAuth authorization codes when users authenticate through that application's normal login flow, enabling token theft without requiring a new application registration or consent event.