Elastic medium stable kql

Entra ID Illicit Consent Grant via Registered Application

Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.

View Source

Detection Logic

FROM logs-azure.auditlogs-* metadata _id, _version, _index
| WHERE (azure.auditlogs.operation_name == "Consent to application"
    
OR event.action == "Consent to application")
  
AND event.outcome == "success"
| MV_EXPAND azure.auditlogs.properties.additional_details.value
| WHERE azure.auditlogs.properties.additional_details.value
    RLIKE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
| RENAME azure.auditlogs.properties.additional_details.value AS Esql.app_id
| STATS
    Esql.timestamp_first_seen = MIN(@timestamp),
    Esql.timestamp_last_seen = MAX(@timestamp),
    Esql.app_display_name_values = VALUES(`azure.auditlogs.properties.target_resources.0.display_name`),
    Esql.service_principal_id_values = VALUES(`azure.auditlogs.properties.target_resources.0.id`),
    Esql.is_admin_consent_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`),
    Esql.is_app_only_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`),
    Esql.on_behalf_of_all_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`),
    Esql.consent_context_tags_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`),
    Esql.consent_permissions_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value`),
    Esql.consent_reason_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value`),
    Esql.user_id_values = VALUES(azure.auditlogs.properties.initiated_by.user.id),
    Esql.ip_address_values = VALUES(azure.auditlogs.properties.initiated_by.user.ipAddress),
    Esql.tenant_id_values = VALUES(azure.tenant_id),
    Esql.correlation_id_values = VALUES(azure.auditlogs.properties.correlation_id),
    Esql.event_count = COUNT(*)
    BY azure.auditlogs.properties.initiated_by.user.userPrincipalName, Esql.app_id
| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes
| KEEP Esql.*, azure.*

Field Validations

Loading…

Comments (0)

Loading comments...