Detect Suspicious OAuth Application Consent Grant in Microsoft 365 in Google Chronicle

rule suspicious_oauth_consent_grant_m365 {
  meta:
    author = "Detection Engineering"
    description = "Detects illicit OAuth consent grants with sensitive API permissions in Microsoft 365 / Entra ID — covers Storm-0558 and Midnight Blizzard consent phishing"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1098.003"
    false_positives = "Legitimate IT-sanctioned app deployments, ISV onboarding, Microsoft first-party app consent"
    reference = "https://www.microsoft.com/security/blog/2023/09/07/microsoft-mitigates-china-based-threat-actor-storm-0558"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = "Azure Active Directory"
    $e.metadata.product_event_type in nocase (
      "Consent to application",
      "Add delegated permission grant",
      "Add OAuth2PermissionGrant",
      "Add app role assignment to service principal"
    )
    $e.security_result.action = "ALLOW"
    (
      re.regex(
        $e.target.resource.attribute.labels["permissions"],
        `(?i)(Mail\.Read|Mail\.ReadWrite|Mail\.Send|Mail\.ReadBasic\.All|Files\.Read\.All|Files\.ReadWrite\.All|offline_access|Directory\.Read\.All|User\.Read\.All|User\.ReadWrite\.All|Contacts\.Read|Contacts\.ReadWrite|Sites\.Read\.All|Sites\.ReadWrite\.All|MailboxSettings\.ReadWrite|Calendars\.ReadWrite|Group\.Read\.All)`
      ) or
      re.regex($e.metadata.product_event_type, `(?i)admin\s+consent`) or
      $e.metadata.product_event_type = "Add app role assignment to service principal"
    )
    $user = $e.principal.user.email_addresses[0]
    $app = $e.target.application
    $src_ip = $e.principal.ip

  condition:
    $e
}