Malicious OAuth App Registration with High-Privilege Scope Grant - T1528

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•1•24

Detects the creation of applications or service principals in Azure AD that involve sensitive OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All) when performed by users identified with elevated risk levels or outside of standard business hours.