Detecting Rouge OAuth Consented Graph App
A user inadvertently granted consent to an external, unverified OAuth application. Exploiting the high-level permissions obtained, a threat actor initiated an attack targeting the tenant’s environment via Microsoft Graph.
Microsoft Sentinel (KQL)
