Azure AD OAuth App Registration with External Redirect URI (AiTM/EvilProxy T1528)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.