Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

OAuth app using the OD file picker permission

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•81

KQL Query from file: OAuth app using the OD file picker permission

Microsoft Sentinel (KQL)

Tags

T1528 - Steal Application Access Token T1527 - Application Access Token T1566.002 - Spearphishing Link T1526 - Cloud Service Discovery T1102 - Web Service T1021.007 - Cloud Services T1106 - Native API T1059.009 - Cloud API T1585.003 - Cloud Accounts T1570 - Lateral Tool Transfer TA0006 - Credential Access TA0005 - Defense Evasion TA0008 - Lateral Movement TA0001 - Initial Access TA0007 - Discovery TA0011 - Command and Control TA0002 - Execution TA0042 - Resource Development Application Event Cloud Api Call Data Exfiltration Office 365 Azure M365 Unified Audit Log Azure Signin Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?