KQL Search

This query is designed to detect suspicious activity related to OAuth consent grants within an organization. Here's a simplified explanation:

• Purpose: The query identifies when a single user or application performs five or more OAuth consent or permission-grant operations within a one-hour period. This behavior is often associated with automated attacks, such as consent-phishing campaigns, where attackers use compromised accounts to give their applications access to sensitive data like emails, files, or directory objects.

• How it Works:

  • The query looks at audit logs from the past two hours.
  • It filters for specific activities related to granting or removing permissions to applications.
  • It identifies the actor (either a user or an application) who initiated these actions.
  • It counts the number of consent operations performed by each actor and checks if it meets or exceeds the threshold of five operations within an hour.
  • If the threshold is met, it calculates the duration and rate of these operations.

• Alert Details:

  • If suspicious activity is detected, an alert is generated with details such as the number of operations, the time taken, and the applications affected.
  • The alert is labeled as high severity due to its potential link to credential access and persistence tactics used by attackers.

• Additional Information:

  • The query references tools like ROADtools and TokenTactics, which can be used in such attacks.
  • It includes mappings to identify the account involved and provides custom details for further investigation.

Overall, this query helps security teams quickly identify and respond to potential security threats involving unauthorized access through OAuth consent grants.