Inbound Email with Microsoft OAuth 'prompt=none' for Consent Phishing

Steven Lim@KQLWizard

•updated Mar 4, 2026•61•0•520

This rule detects inbound emails containing a URL that initiates an OAuth 2.0 authorization flow for Microsoft Online, specifically looking for the 'prompt=none' parameter. This combination can be indicative of consent phishing attempts where an attacker tries to trick users into granting permissions to a malicious application without explicit interaction, often by pre-approving the prompt. The rule filters for inbound emails that were not blocked, suggesting they reached the user's inbox.