Application Granted Microsoft Permissions
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
Sigma
