Elastic high stable kql

Entra ID OAuth Application Redirect URI Modified

Identifies modifications to OAuth application redirect URIs (ReplyUrls) in Entra ID. Adding an attacker-controlled redirect URI to an existing trusted application allows interception of OAuth authorization codes when users authenticate through that application's normal login flow, enabling token theft without requiring a new application registration or consent event.

View Source

Detection Logic

data_stream.dataset: "azure.auditlogs" and
azure.auditlogs.operation_name: "Update application" and
event.outcome: ("Success" or "success") and
azure.auditlogs.properties.target_resources.*.modified_properties.*.display_name: "AppAddress"

False Positives

⚠ Developers adding localhost redirect URIs for local development environments. CI/CD pipelines updating production redirect URIs during deployment. Application owners adding redirect URIs for new platform support.

Field Validations

Loading…

Comments (0)

Loading comments...