Malicious OAuth App Consent Grant with Risky Delegated Scopes (T1528)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•6

Detects successful OAuth application consent grants or service principal role assignments involving sensitive permissions, such as read access to mail, contacts, files, or directory information. This activity is a common indicator of OAuth-based phishing or unauthorized persistent access to cloud resources.