Kali365 - Illicit OAuth Consent Grant (T1528)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•11

Detects the compromised user granting read/write permissions to a highly privileged, unfamiliar third-party application via the OAuth consent framework. Specifically looks for 'Consent to application' operations where granted permissions include 'Mail.ReadWrite', 'Contacts.Read', or 'offline_access'.