Suspicious OAuth Consent Grant Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•11

Detects suspicious activity related to OAuth2PermissionGrant operations, specifically looking for a high volume of successful consent grants by a single user within a short timeframe. This could indicate an attacker attempting to gain broad access to resources by granting permissions to a malicious OAuth application.