-
Entra ID Illicit Consent Grant via Registered Application
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access Tactic: Credential Access Noise: Medium Performance: Fast Profile: Recommended Threat: OAuth App Consent Rule Type: ES|QL Platform: Entra ID ·Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.
Read More -
Google Workspace Object Copied from External Drive with App Consent
Sep 19, 2026 · Domain: Cloud Data Source: Google Workspace Data Source: Google Workspace Audit Logs Tactic: Initial Access Tactic: Execution Tactic: Persistence Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: OAuth App Consent Rule Type: Event Correlation (EQL) Platform: Google Workspace Domain: SaaS ·Detects when a user copies a Google document, spreadsheet, form, or script from an external Drive into their Workspace Drive and shortly after authorizes a custom Google OAuth application. Adversaries may send spearphishing links with a /copy URI parameter so the victim replicates a malicious object locally. Container-bound Apps Script can then execute on open and prompt the user for OAuth consent, granting the attacker's application access to Workspace data.
Read More -
M365 Identity OAuth Illicit Consent Grant by Rare Client and User
Sep 19, 2026 · Domain: Cloud Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access Tactic: Credential Access Noise: Medium Performance: Normal Profile: Recommended Threat: OAuth App Consent Rule Type: New Terms Platform: Microsoft 365 Domain: SaaS Domain: Email ·Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user.
Read More -
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials
Identifies a failed OAuth 2.0 token grant attempt for a public client app using client credentials. This event is generated when a public client app attempts to exchange a client credentials grant for an OAuth 2.0 access token, but the request is denied due to the lack of required scopes. This could indicate compromised client credentials in which an adversary is attempting to obtain an access token for unauthorized scopes. This is a New Terms rule where the
okta.actor.display_namefield value has not been seen in the last 14 days regarding this event.
Read More