Risky OAuth app grant with high/critical scopes via Netskope CASB
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Microsoft Sentinel (KQL)
