Tycoon Victim Grants Persistent OAuth Permissions
Detects an account granting offline access, mail, files, directory, or user impersonation permissions shortly after anomalous authentication. This rule is designed to identify potential persistence mechanisms established by adversaries leveraging OAuth applications, as seen in campaigns like Tycoon 2FA AITM.
Microsoft Sentinel (KQL)
