Most Popular Detection 2026: Illicit OAuth Consent Grant and Malicious Azure AD App Registration (T1098.001)

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

Detects user-granted OAuth consent in Microsoft Entra ID (formerly Azure AD) involving high-risk scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This pattern is characteristic of illicit consent-grant phishing, where attackers entice users to authorize malicious applications to bypass multi-factor authentication (MFA) and establish persistent, programmatic access to sensitive mailbox and file resources.