Best Detection of 2026 Series: Illicit OAuth Consent Grant and Malicious App Registration

Ibrahim Saud@tektrix

•updated Sep 27, 2026•1•0•1

Detects the granting of high-privilege permissions (e.g., mail.read, files.readwrite) to a newly registered OAuth application (less than 24 hours old), followed by high-volume API activity from that same application within one hour. This behavior is indicative of an illicit OAuth consent grant attack, where an adversary lures a user into granting permissions to a malicious application to maintain persistent access to cloud resources or perform data exfiltration.