detecting-suspicious-oauth-application-consent

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

跳到安装

仓库: xalgord/xalgorix
最近来源活动: 2026年6月6日 16:41
检测到的 SKILL.md 语言: 英语
星标: 813
分支: 146

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/xalgord/xalgorix --skill detecting-suspicious-oauth-application-consent

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

查看这个仓库的全部 Skills

Detecting Suspicious OAuth Application Consent

Overview

Illicit consent grant attacks trick users into granting excessive permissions to malicious OAuth applications in Azure AD / Microsoft Entra ID. This skill uses the Microsoft Graph API to enumerate OAuth2 permission grants, analyze application permissions for overly broad scopes, review directory audit logs for consent events, and flag high-risk applications based on publisher verification status and permission scope.

When to Use

When investigating security incidents that require detecting suspicious oauth application consent

When building detection rules or threat hunting queries for this domain

When SOC analysts need structured procedures for this analysis type

When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

The most dangerous grants this Graph workflow can miss:

/oauth2PermissionGrants returns only DELEGATED consent. Application permissions (app roles) live under servicePrincipals/{id}/appRoleAssignments — querying only oauth2PermissionGrants misses app-only Mail.Read/Files.ReadWrite.All/Directory.ReadWrite.All, which run with no signed-in user and are the worst case.

ConsentType == "AllPrincipals" (tenant-wide admin consent) is far higher risk than "Principal" (single user) — flag AllPrincipals explicitly rather than treating all grants equally.

Programmatic grants show as Add app role assignment to service principal / Add delegated permission grant in directoryAudits, not just Consent to application — watching only the latter misses them.

offline_access scope = refresh-token persistence — treat as high-signal even when other scopes look benign.

Null verifiedPublisher isn't malicious by itself (many legit internal apps) — combine with risky scope + recent creation to cut FP.

Validate: confirm the app token actually carries Application.Read.All (with only Directory.Read.All the enumeration returns partial data and looks clean); cross-check a flagged app against the directoryAudits consent event to recover the granting user and IP; maintain an allowlist of approved appIds to suppress known-good apps.