Malicious OAuth Consent Grant Requesting High-Privilege Graph Scopes

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects instances where a non-administrative user grants an OAuth application consent to access high-privilege Microsoft Graph scopes, such as 'Mail.Read', 'Directory.ReadWrite.All', or 'offline_access'. This pattern is frequently used in consent phishing attacks to maintain persistent access to sensitive cloud resources.