End User Consent to Application
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
Sigma
