Payload Download Following OAuth Redirection Abuse
Detects a file download where the referrer URL is a Microsoft Entra ID OAuth endpoint returning an error. This pattern is indicative of an attacker abusing OAuth's error-handling redirection mechanism to lead a user to a malicious payload on an attacker-controlled domain.
Microsoft Sentinel (KQL)
