Splunk unknown stable spl

O365 User Consent Denied for OAuth Application

The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Office 365 environment. This detection leverages O365 audit logs, focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, it captures instances where users have actively rejected permission requests. This activity is significant as it may indicate users spotting potentially suspicious or unfamiliar applications. If confirmed malicious, it suggests an attempt by a potentially harmful application to gain unauthorized access, which was proactively blocked by the user.

View Source

Detection Logic

`o365_graph` status.errorCode=65004
| rename userPrincipalName as user
| rename ipAddress as src_ip
| stats min(_time) as firstTime max(_time) as lastTime
    BY user src_ip appDisplayName
       status.failureReason
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_user_consent_denied_for_oauth_application_filter`

False Positives

  • ⚠ OAuth applications that require mail permissions may be legitimate, investigate and filter as needed.

Field Validations

Loading…

Comments (0)

Loading comments...