Entra ID Application Excessive Permission Grant
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
YARA-L
