Suspicious OAuth Application Registered in Azure AD

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.