Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect anomalous external OAuthApp activity using ActorInfoString

Steven Lim@KQLWizard

•updated Jul 2, 2025•27•7•242

KQL Query

Microsoft Sentinel (KQL)

Tags

T1528 - Steal Application Access Token T1527 - Application Access Token T1098.003 - Additional Cloud Roles T1566.002 - Spearphishing Link T1087.003 - Email Account TA0006 - Credential Access TA0005 - Defense Evasion TA0008 - Lateral Movement TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery Application Event Cloud Api Call Authentication Attempt Office 365 M365 Unified Audit Log Microsoft Exchange Server Oauth Server Generickql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?