Detect Cloud Application Integration in IBM QRadar
This detection identifies adversaries achieving persistence in SaaS environments by abusing OAuth application integrations. Attackers register malicious applications, hijack existing integrations, or consent to adversary-controlled apps from high-privileged accounts to maintain access even after account compromise or password resets. Detection focuses on anomalous OAuth consent grants, new application registrations, service principal creation, and permission escalation events in Microsoft 365, Azure AD/Entra ID, and Google Workspace environments. Particular attention is paid to admin consent grants for high-privilege scopes, application registrations from non-admin users, and OAuth grants that occur outside normal business workflows.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1671 Cloud Application Integration
- Canonical reference
- https://attack.mitre.org/techniques/T1671/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
"username" AS UserPrincipalName,
sourceip AS SourceIP,
"EventName" AS Operation,
CASE
WHEN "EventName" ILIKE '%delete%' OR "EventName" ILIKE '%remove%' THEN 85
WHEN "EventName" ILIKE '%add%' OR "EventName" ILIKE '%create%' THEN 70
WHEN "EventName" ILIKE '%update%' THEN 65
ELSE 55
END AS RiskScore
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Azure', 'Azure Active Directory Audit Log')
AND ("EventName" ILIKE '%subscription%'
OR "EventName" ILIKE '%consent%'
OR "EventName" ILIKE '%permission%'
OR "EventName" ILIKE '%role%')
AND RiskScore >= 65
ORDER BY EventTime DESC
LAST 24 HOURSIBM QRadar AQL detection for Cloud Application Integration (T1671). Queries QRadar event pipeline for indicators consistent with cloud application integration adversary techniques using MITRE ATT&CK-aligned event categorization.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators deploying enterprise applications that require admin consent for business-critical permissions
- Productivity application onboarding during organizational rollouts (e.g., deploying a new CRM, ITSM, or HR integration)
- Third-party security vendors requiring Mail.Read or Directory.Read.All for legitimate CASB, DLP, or threat protection services
Other platforms for T1671
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register Malicious OAuth Application in Azure AD
Expected signal: AuditLogs entries: OperationName='Add application' and OperationName='Add service principal' with the new App ID in TargetResources. OperationName='Add delegated permission grant' showing Graph API permission additions.
- Test 2Grant Admin Consent to Existing Application via PowerShell
Expected signal: AuditLogs: OperationName='Add OAuth2PermissionGrant' with ConsentType='AllPrincipals' and Scope containing 'Mail.Read'. InitiatedBy will show the Global Administrator account. ResultType should be 'Success'.
- Test 3Add Client Secret to Existing Service Principal for Persistent API Access
Expected signal: AuditLogs: OperationName='Add password to service principal' with the target App ID in TargetResources and the credential display name 'AtomicTest-PersistentSecret'. AADSignInLogs: Service principal sign-in using client_credentials grant type showing the App ID authenticating to Microsoft Graph.
References (9)
- https://attack.mitre.org/techniques/T1671/
- https://pushsecurity.com/blog/saas-persistence-techniques/
- https://saasattacks.com/evil-twin-integrations
- https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-2024
- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
- https://www.huntress.com/blog/microsoft-365-oauth-phishing
- https://pushsecurity.com/blog/slack-persistence/
- https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals
- https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow
Unlock Pro Content
Get the full detection package for T1671 including response playbook, investigation guide, and atomic red team tests.