Entra ID OAuth Application Redirect URI Modified

  1[metadata]
  2creation_date = "2026/05/20"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/05/20"
  6
  7[rule]
  8author = ["Elastic", "descambiado"]
  9description = """
 10Identifies modifications to OAuth application redirect URIs (ReplyUrls) in Entra ID. Adding an
 11attacker-controlled redirect URI to an existing trusted application allows interception of OAuth
 12authorization codes when users authenticate through that application's normal login flow, enabling
 13token theft without requiring a new application registration or consent event.
 14"""
 15false_positives = [
 16    """
 17    Developers adding localhost redirect URIs for local development environments.
 18    CI/CD pipelines updating production redirect URIs during deployment.
 19    Application owners adding redirect URIs for new platform support.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-azure.auditlogs-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Entra ID OAuth Application Redirect URI Modified"
 27note = """## Triage and analysis
 28
 29### Investigating Entra ID OAuth Application Redirect URI Modified
 30
 31A redirect URI addition to an existing trusted application does not generate a consent event and does
 32not require registering a new application -- both of which are commonly monitored. The modified
 33application retains all existing user consents.
 34
 35#### Possible investigation steps
 36
 37- Identify the actor who modified the application (`azure.auditlogs.properties.initiated_by`) and
 38  verify whether the change was authorized by the application owner or a change management ticket.
 39- Review the specific URIs added by comparing `modifiedProperties.oldValue` and `newValue` for the
 40  `ReplyUrls` field in the audit event's `target_resources`.
 41- Geolocate and WHOIS the domain of any newly added URI -- hosting providers, recently registered
 42  domains, or URL shorteners are strong indicators of compromise.
 43- Check whether the actor recently became an owner of this application: look for
 44  "Add owner to application" events in AuditLogs for the same application object ID.
 45- Review the application's Graph API permissions -- applications with Mail, Files, or directory
 46  scopes are the highest-value targets for redirect URI hijacking.
 47
 48### False positive analysis
 49
 50- Localhost and loopback URIs (`http://localhost:*`, `http://127.0.0.1:*`) added by developers are
 51  expected in non-production applications. Verify the application's sensitivity before closing.
 52- CI/CD-driven URI updates typically originate from service principal actors, not human users.
 53
 54### Response and remediation
 55
 56- Remove the unauthorized redirect URI via Entra ID > App registrations > Authentication.
 57- Revoke all tokens issued to the application since the modification timestamp.
 58- Review sign-in logs for the application for any sign-ins from unexpected sources after the change.
 59- If the URI was externally controlled, treat as a full OAuth token compromise for all users of
 60  the application and initiate token revocation and user notification.
 61"""
 62references = [
 63    "https://learn.microsoft.com/en-us/entra/identity-platform/reply-url",
 64    "https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/",
 65]
 66risk_score = 47
 67rule_id = "8efcd3da-103b-4a65-8ab2-6a3a9df7ba8b"
 68severity = "medium"
 69tags = [
 70    "Domain: Cloud",
 71    "Domain: Identity",
 72    "Data Source: Azure",
 73    "Data Source: Microsoft Entra ID",
 74    "Data Source: Microsoft Entra ID Audit Logs",
 75    "Use Case: Identity and Access Audit",
 76    "Tactic: Persistence",
 77    "Tactic: Credential Access",
 78    "Resources: Investigation Guide",
 79]
 80timestamp_override = "event.ingested"
 81type = "query"
 82
 83query = '''
 84data_stream.dataset: "azure.auditlogs" and
 85azure.auditlogs.operation_name: "Update application" and
 86event.outcome: ("Success" or "success") and
 87azure.auditlogs.properties.target_resources.*.modified_properties.*.display_name: "AppAddress"
 88'''
 89
 90[[rule.threat]]
 91framework = "MITRE ATT&CK"
 92
 93[[rule.threat.technique]]
 94id = "T1556"
 95name = "Modify Authentication Process"
 96reference = "https://attack.mitre.org/techniques/T1556/"
 97
 98[rule.threat.tactic]
 99id = "TA0003"
100name = "Persistence"
101reference = "https://attack.mitre.org/tactics/TA0003/"
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105
106[[rule.threat.technique]]
107id = "T1528"
108name = "Steal Application Access Token"
109reference = "https://attack.mitre.org/techniques/T1528/"
110
111[rule.threat.tactic]
112id = "TA0006"
113name = "Credential Access"
114reference = "https://attack.mitre.org/tactics/TA0006/"