App Redirect URI Modified to External/Suspicious Endpoint
Detects the addition of suspicious, attacker-controlled URLs (such as webhook.site, ngrok.io, or pipedream.net) as valid redirect URIs in an OAuth application's configuration. This technique can be used by an adversary to intercept OAuth authorization codes or tokens by luring users through a malicious authorization link, enabling persistent unauthorized access without further consent.
Microsoft Sentinel (KQL)
