Phishing Series 2026: OAuth Illicit Consent Grant & Malicious App Registration

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•0

This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.