High-risk OAuth consent (offline_access/Mail/Files) after risky sign-in

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

This rule detects instances where a user grants high-risk OAuth application permissions (e.g., Mail or Files access) within 30 minutes of a risky or MFA-challenged sign-in event. This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker successfully steals a session and immediately establishes persistent access to the victim's resources via OAuth consent.