« Entra ID Service Principal Federated Credential Authentication by Unusual Client Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.28

Entra ID Illicit Consent Grant via Registered Application

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Entra ID Illicit Consent Grant via Registered Application

edit

Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 8m

Searches indices from: now-7d (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: Identity
  • Data Source: Azure
  • Data Source: Microsoft Entra ID
  • Data Source: Microsoft Entra ID Audit Logs
  • Use Case: Identity and Access Audit
  • Resources: Investigation Guide
  • Tactic: Initial Access
  • Tactic: Credential Access

Version: 221

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Entra ID Illicit Consent Grant via Registered Application

Adversaries may register a malicious application in Microsoft Entra ID and trick users into granting excessive permissions via OAuth consent. These applications can access sensitive data—such as mail, profiles, or files—on behalf of the user once consent is granted. This is commonly delivered via spearphishing links that prompt users to approve permissions for seemingly legitimate applications.

This rule identifies a new consent grant event based on Azure audit logs where a user or admin granted consent to an application.

This rule uses ES|QL aggregation-based new terms logic with a 7-day history window. It extracts the AppId from the multi-valued additional_details array using MV_EXPAND and UUID regex filtering, then alerts when the user-application pair is first seen within the last 9 minutes. Alerts are suppressed by AppId and user principal name for 6 hours. Each distinct user-application pair therefore produces a single alert, preserving per-victim visibility: an application consented to by multiple users raises one alert per user, so the spread of a consent phishing campaign remains visible in the alert list.

Possible investigation steps

  • Review azure.auditlogs.properties.additional_details.value to identify the AppId and User-Agent values to determine which application was granted access and how the request was initiated. Pivot on the AppId in the Azure portal under Enterprise Applications to investigate further.
  • Review azure.auditlogs.properties.initiated_by.user.userPrincipalName to identify the user who approved the application. Investigate their recent activity for signs of phishing, account compromise, or anomalous behavior during the timeframe of the consent.
  • Review azure.auditlogs.properties.initiated_by.user.ipAddress to assess the geographic source of the consent action. Unexpected locations or IP ranges may indicate adversary-controlled infrastructure.
  • Review azure.auditlogs.properties.target_resources.display_name to evaluate whether the application name is familiar, expected, or potentially spoofing a known service.
  • Review azure.auditlogs.properties.target_resources.modified_properties.display_name to inspect key indicators of elevated privilege or risk, including:
  • ConsentContext.IsAdminConsent to determine if the application was granted tenant-wide admin access.
  • ConsentContext.OnBehalfOfAll to identify whether the app was granted permissions on behalf of all users in the tenant.
  • ConsentAction.Permissions to evaluate the specific scopes and data access the application requested. Scope combinations such as offline_access with Mail.ReadWrite, Files.ReadWrite.All, or Chat.Read are characteristic of mailbox and file exfiltration.
  • ConsentAction.Reason to determine whether Microsoft’s own risk heuristics flagged the application. A value of Risky application detected means Microsoft scored the app as suspicious at the time consent was granted and should raise the priority of the review. Note this reason is only populated on admin-consent events, and its absence does not clear the application; a flagged app is also not necessarily malicious, since Microsoft’s heuristic can flag legitimate apps.
  • TargetId.ServicePrincipalNames to confirm the service principal associated with the granted permissions.
  • Review azure.tenant_id to confirm the activity originated from your tenant and is not related to a cross-tenant application.
  • Review @timestamp and azure.auditlogs.properties.correlation_id to pivot into related sign-in, token usage, or application activity for further context.

False positive analysis

  • Some applications may request high-privilege scopes for legitimate purposes. Validate whether the application is verified, developed by Microsoft, or approved internally by your organization.
  • Review publisher verification, app ownership, and scope alignment with the intended business use case.
  • A ConsentAction.Reason of Risky application detected raises confidence that the consent is worth investigating, but Microsoft’s risk heuristic is advisory and can flag legitimate applications (including internal line-of-business apps and newly registered tenant applications). Conversely, the absence of the flag does not make the consent benign, so weigh it alongside the requested scopes, admin-consent context, and the application’s home tenant rather than in isolation.

Response and remediation

  • Revoke the application’s OAuth grant using Graph API or PowerShell. Use the Remove-AzureADOAuth2PermissionGrant cmdlet.
  • Remove the associated service principal from Azure AD.
  • Reset credentials or revoke tokens for affected users.
  • Block the application via Conditional Access or Defender for Cloud Apps policies.
  • Enable the Admin Consent Workflow in Azure AD to prevent unsanctioned user approvals in the future.
  • Report any malicious applications to Microsoft to protect other tenants.

Rule query

edit
FROM logs-azure.auditlogs-* metadata _id, _version, _index
| WHERE (azure.auditlogs.operation_name == "Consent to application"
    OR event.action == "Consent to application")
  AND event.outcome == "success"

| MV_EXPAND azure.auditlogs.properties.additional_details.value
| WHERE azure.auditlogs.properties.additional_details.value
    RLIKE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
| RENAME azure.auditlogs.properties.additional_details.value AS Esql.app_id

| STATS
    Esql.timestamp_first_seen = MIN(@timestamp),
    Esql.timestamp_last_seen = MAX(@timestamp),
    Esql.app_display_name_values = VALUES(`azure.auditlogs.properties.target_resources.0.display_name`),
    Esql.service_principal_id_values = VALUES(`azure.auditlogs.properties.target_resources.0.id`),
    Esql.is_admin_consent_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`),
    Esql.is_app_only_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`),
    Esql.on_behalf_of_all_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`),
    Esql.consent_context_tags_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`),
    Esql.consent_permissions_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value`),
    Esql.consent_reason_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value`),
    Esql.user_id_values = VALUES(azure.auditlogs.properties.initiated_by.user.id),
    Esql.ip_address_values = VALUES(azure.auditlogs.properties.initiated_by.user.ipAddress),
    Esql.tenant_id_values = VALUES(azure.tenant_id),
    Esql.correlation_id_values = VALUES(azure.auditlogs.properties.correlation_id),
    Esql.event_count = COUNT(*)
    BY azure.auditlogs.properties.initiated_by.user.userPrincipalName, Esql.app_id

| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes
| KEEP Esql.*, azure.*

Framework: MITRE ATT&CKTM

« Entra ID Service Principal Federated Credential Authentication by Unusual Client Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource »