2026 Critical Cloud Identity Detection: OAuth App-Driven Mailbox Delegate/Folder Permission Grant (BEC)
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
Cortex XDR
