2026 Critical Cloud Identity Detection: Illicit OAuth Consent Grant to Unverified App Within 10 Min of Registration

Ibrahim Saud@tektrix

•updated 27 days ago•3•0•2

Detects potential consent phishing attacks by identifying newly registered multi-tenant Azure AD applications that receive OAuth consent from end-users within a short timeframe (10 minutes) of application registration. The rule specifically flags consents requesting high-risk delegated scopes (e.g., Mail.Read, Mail.Send, Files.ReadWrite.All, offline_access) where the application has not been verified by a trusted publisher.