Entra ID Illicit Consent Grant via Registered Application

  1[metadata]
  2creation_date = "2020/09/01"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/03/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and
 11register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is
 12accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This
 13establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.
 14"""
 15from = "now-7d"
 16interval = "8m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "Entra ID Illicit Consent Grant via Registered Application"
 20note = """## Triage and analysis
 21
 22### Investigating Entra ID Illicit Consent Grant via Registered Application
 23
 24Adversaries may register a malicious application in Microsoft Entra ID and trick users into granting excessive permissions via OAuth consent. These applications can access sensitive data—such as mail, profiles, or files—on behalf of the user once consent is granted. This is commonly delivered via spearphishing links that prompt users to approve permissions for seemingly legitimate applications.
 25
 26This rule identifies a new consent grant event based on Azure audit logs where a user or admin granted consent to an application.
 27
 28This rule uses ES|QL aggregation-based new terms logic with a 7-day history window. It extracts the AppId from the multi-valued additional_details array using MV_EXPAND and UUID regex filtering, then alerts when the user-application pair is first seen within the last 9 minutes OR when Microsoft flags the consent as a "Risky application detected".
 29
 30#### Possible investigation steps
 31
 32- Review `azure.auditlogs.properties.additional_details.value` to identify the AppId and User-Agent values to determine which application was granted access and how the request was initiated. Pivot on the AppId in the Azure portal under Enterprise Applications to investigate further.
 33- Review `azure.auditlogs.properties.initiated_by.user.userPrincipalName` to identify the user who approved the application. Investigate their recent activity for signs of phishing, account compromise, or anomalous behavior during the timeframe of the consent.
 34- Review `azure.auditlogs.properties.initiated_by.user.ipAddress` to assess the geographic source of the consent action. Unexpected locations or IP ranges may indicate adversary-controlled infrastructure.
 35- Review `azure.auditlogs.properties.target_resources.display_name` to evaluate whether the application name is familiar, expected, or potentially spoofing a known service.
 36- Review `azure.auditlogs.properties.target_resources.modified_properties.display_name` to inspect key indicators of elevated privilege or risk, including:
 37  - ConsentContext.IsAdminConsent to determine if the application was granted tenant-wide admin access.
 38  - ConsentContext.OnBehalfOfAll to identify whether the app was granted permissions on behalf of all users in the tenant.
 39  - ConsentAction.Permissions to evaluate the specific scopes and data access the application requested.
 40  - ConsentAction.Reason to understand if Microsoft flagged the activity or if any reason was recorded by the platform.
 41  - TargetId.ServicePrincipalNames to confirm the service principal associated with the granted permissions.
 42- Review `azure.tenant_id` to confirm the activity originated from your tenant and is not related to a cross-tenant application.
 43- Review `@timestamp` and `azure.auditlogs.properties.correlation_id` to pivot into related sign-in, token usage, or application activity for further context.
 44
 45### False positive analysis
 46
 47- Some applications may request high-privilege scopes for legitimate purposes. Validate whether the application is verified, developed by Microsoft, or approved internally by your organization.
 48- Review publisher verification, app ownership, and scope alignment with the intended business use case.
 49
 50### Response and remediation
 51
 52- Revoke the application’s OAuth grant using Graph API or PowerShell. Use the Remove-AzureADOAuth2PermissionGrant cmdlet.
 53- Remove the associated service principal from Azure AD.
 54- Reset credentials or revoke tokens for affected users.
 55- Block the application via Conditional Access or Defender for Cloud Apps policies.
 56- Enable the Admin Consent Workflow in Azure AD to prevent unsanctioned user approvals in the future.
 57- Report any malicious applications to Microsoft to protect other tenants.
 58"""
 59references = [
 60    "https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices",
 61    "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide",
 62    "https://www.cloud-architekt.net/detection-and-mitigation-consent-grant-attacks-azuread/",
 63    "https://docs.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth#how-to-detect-risky-oauth-apps",
 64]
 65risk_score = 47
 66rule_id = "1c6a8c7a-5cb6-4a82-ba27-d5a5b8a40a38"
 67severity = "medium"
 68tags = [
 69    "Domain: Cloud",
 70    "Domain: Identity",
 71    "Data Source: Azure",
 72    "Data Source: Microsoft Entra ID",
 73    "Data Source: Microsoft Entra ID Audit Logs",
 74    "Use Case: Identity and Access Audit",
 75    "Resources: Investigation Guide",
 76    "Tactic: Initial Access",
 77    "Tactic: Credential Access",
 78]
 79type = "esql"
 80
 81query = '''
 82FROM logs-azure.auditlogs-* metadata _id, _version, _index
 83| WHERE (azure.auditlogs.operation_name == "Consent to application"
 84    OR event.action == "Consent to application")
 85  AND event.outcome == "success"
 86
 87| MV_EXPAND azure.auditlogs.properties.additional_details.value
 88| WHERE azure.auditlogs.properties.additional_details.value
 89    RLIKE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
 90| RENAME azure.auditlogs.properties.additional_details.value AS Esql.app_id
 91
 92| STATS
 93    Esql.timestamp_first_seen = MIN(@timestamp),
 94    Esql.timestamp_last_seen = MAX(@timestamp),
 95    Esql.app_display_name_values = VALUES(`azure.auditlogs.properties.target_resources.0.display_name`),
 96    Esql.service_principal_id_values = VALUES(`azure.auditlogs.properties.target_resources.0.id`),
 97    Esql.is_admin_consent_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`),
 98    Esql.is_app_only_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`),
 99    Esql.on_behalf_of_all_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`),
100    Esql.consent_context_tags_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`),
101    Esql.consent_permissions_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value`),
102    Esql.consent_reason_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value`),
103    Esql.user_id_values = VALUES(azure.auditlogs.properties.initiated_by.user.id),
104    Esql.ip_address_values = VALUES(azure.auditlogs.properties.initiated_by.user.ipAddress),
105    Esql.tenant_id_values = VALUES(azure.tenant_id),
106    Esql.correlation_id_values = VALUES(azure.auditlogs.properties.correlation_id),
107    Esql.event_count = COUNT(*)
108    BY azure.auditlogs.properties.initiated_by.user.userPrincipalName, Esql.app_id
109
110| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes
111    OR Esql.consent_reason_values LIKE "*Risky application detected*"
112| KEEP Esql.*, azure.*
113'''
114
115
116[[rule.threat]]
117framework = "MITRE ATT&CK"
118
119[[rule.threat.technique]]
120id = "T1566"
121name = "Phishing"
122reference = "https://attack.mitre.org/techniques/T1566/"
123
124[[rule.threat.technique.subtechnique]]
125id = "T1566.002"
126name = "Spearphishing Link"
127reference = "https://attack.mitre.org/techniques/T1566/002/"
128
129[[rule.threat.technique]]
130id = "T1199"
131name = "Trusted Relationship"
132reference = "https://attack.mitre.org/techniques/T1199/"
133
134[rule.threat.tactic]
135id = "TA0001"
136name = "Initial Access"
137reference = "https://attack.mitre.org/tactics/TA0001/"
138[[rule.threat]]
139framework = "MITRE ATT&CK"
140[[rule.threat.technique]]
141id = "T1528"
142name = "Steal Application Access Token"
143reference = "https://attack.mitre.org/techniques/T1528/"
144
145
146[rule.threat.tactic]
147id = "TA0006"
148name = "Credential Access"
149reference = "https://attack.mitre.org/tactics/TA0006/"