Threat Hunt: Overly permissive or sensitive delegated permissions of OAuth applications

Awais Munir@iawais

•updated Aug 8, 2025•10•2•77

Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions. Key Actions: Finds enabled OAuth apps and retrieves their latest state (arg_max). Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All). Notes publisher verification, origin, and last modification date. Marks risky apps via HasRiskyPermissions flag. Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.