OAuth Phishing Attempt via Malicious Redirect URL

Steven Lim@KQLWizard

•updated Mar 3, 2026•33•0•382

This rule detects emails containing URLs that initiate OAuth 2.0 authorization flows for Microsoft or Google, and where the URL contains a known malicious OAuth ID. This is indicative of an OAuth phishing attempt, where attackers try to trick users into granting access to malicious applications.