Detection of High-Risk OAuth App Consent in Azure AD
Detects when a non-approved application is granted high-risk permissions via consent in Azure AD. This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
Microsoft Sentinel (KQL)
