Attachment: Suspicious Office 365 app authorization (OAuth) link

calendar Oct 4, 2026  ·
Share on: linkedin copy

Detects inbound messages whose PDF, HTML, DOCX, or PPTX attachments contain a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account. ICS and EML attachments are covered by separate rules.

Sublime rule (View on GitHub)

 1name: "Attachment: Suspicious Office 365 app authorization (OAuth) link"
 2description: "Detects inbound messages whose PDF, HTML, DOCX, or PPTX attachments contain a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account. ICS and EML attachments are covered by separate rules."
 3references:
 4  - "https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset"
 5type: "rule"
 6severity: "high"
 7source: |
 8  type.inbound
 9  and any(filter(attachments, .file_type in ("pdf", "html", "docx", "pptx")),
10          any(file.explode(.),
11              any(.scan.url.urls,
12                  (
13                    .domain.domain in (
14                      'login.microsoftonline.com',
15                      'login.microsoft.com'
16                    )
17                    or strings.icontains(.query_params,
18                                         "login.microsoftonline.com",
19                                         'login.microsoft.com'
20                    )
21                  )
22                  and (
23                    strings.ilike(.query_params,
24                                  '*offline_access*',
25                                  '*.readwrite*',
26                                  '*.read*',
27                                  '*ctx=*',
28                                  '*prompt=none*'
29                    )
30                    or (
31                      strings.icontains(.path, '/common/reprocess')
32                      and strings.icontains(.query_params, 'ctx=')
33                      and strings.icontains(.query_params, 'sessionId=')
34                    )
35                  )
36              )
37          )
38  )  
39attack_types:
40  - "Credential Phishing"
41detection_methods:
42  - "URL analysis"
43related_detections:
44  - "link_office365_suspicious_app_authorization.yml"
45  - "attachment_ics_link_office365_suspicious_app_authorization.yml"
46  - "attachment_eml_link_office365_suspicious_app_authorization.yml"
47id: "b25398fa-42c6-5add-a9ee-f1f1ed586447"
to-top