Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

KQL query to oversee the privileged OAuth grants allocated to the Microsoft Graph Command Line Tools OAuth App

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•76

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1098 - Account Manipulation T1071 - Application Layer Protocol TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control T1528 - Steal Application Access Token T1527 - Application Access Token T1566.002 - Spearphishing Link T1526 - Cloud Service Discovery T1102 - Web Service T1021.007 - Cloud Services T1659 - Content Injection T1488 - Disk Content Wipe T1561.001 - Disk Content Wipe TA0006 - Credential Access TA0008 - Lateral Movement TA0007 - Discovery TA0040 - Impact Cloud Api Call Admin Activity Application Event Azure Office 365 M365 Unified Audit Log Azure Activity Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?