Most Popular Detection 2026: Malicious OAuth App Consent Grant Requesting High-Privilege Scopes

Ibrahim Saud@tektrix

•updated 28 days ago•1•0•1

Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.