Elastic medium stable kql

M365 Identity OAuth Illicit Consent Grant by Rare Client and User

Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user.

View Source

Detection Logic

data_stream.dataset: "o365.audit"
  and o365.audit.Actor.Type: 5
  and event.action: "Consent to application."
  and event.outcome: "success"
  and o365.audit.Target.Type: (0 or 2 or 3 or 9 or 10)
  and o365.audit.UserId: *
  and o365.audit.ObjectId: *

Field Validations

Loading…

Comments (0)

Loading comments...