T1528Credential AccessAdvancedDefense plan →

Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·15 min read

A comprehensive map of the attack surface on the OAuth permission model of Microsoft Graph API: illicit consent grant (T1528), service principal credential addition (T1098.001), application role escalation chains (T1098.003), and high-risk permission abuse. For each technique, Entra ID audit signals, KQL/Sigma, and hardening controls are provided.

Exploit

Prevention

Detection

Defense profile:7 detection rules 6 mitigations 10 baseline controls 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Prevention note: The most common entry point in Microsoft Graph API permission abuse is users granting consent to applications from unverified publishers. In Entra ID, User consent settings should be restricted, and admin approval should be required for applications from unverified publishers. Existing OAuth permissions should be audited regularly; in particular, high-privilege and unconsented application roles such as Mail.Read and Files.ReadWrite.All should be revoked. A common mistake: failing to monitor the active permissions of consented applications afterward (MITRE ATT&CK T1528).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

HackTool - Koh Default Named Pipe

Detects creation of default named pipes used by the Koh tool

critical

sigmaTest

Show ruleHide rule

title: HackTool - Koh Default Named Pipe
id: 0adc67e0-a68f-4ffd-9c43-28905aad5d6a
status: test
description: Detects creation of default named pipes used by the Koh tool
references:
    - https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-08
modified: 2023-08-07
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.stealth
    - attack.t1528
    - attack.t1134.001
logsource:
    product: windows
    category: pipe_created
    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
detection:
    selection:
        PipeName|contains:
            - '\imposecost'
            - '\imposingcost'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Not validated

Telemetry required to run: windows; Named Pipe Eventswindows / pipe_createdwindows

False positive: Unlikely

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Cloud Access Security Broker (CASB)

Prevention

Visibility and control over SaaS/cloud application usage; OAuth application and data flow monitoring (Defender for Cloud Apps).

OAuth and Application Consent Governance

Hardening

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Credential Access tactic

T1003.001Credential AccessAdvanced

A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.

June 13, 202631 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1528: Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

Application URI Configuration Changes

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

high

sigmaTest

Show ruleHide rule

title: Application URI Configuration Changes
id: 0055ad1f-be85-4798-83cf-a6da17c993b3
status: test
description: |
    Detects when a configuration change is made to an applications URI.
    URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-02
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1528
    - attack.t1078.004
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Update Application Sucess- Property Name AppAddress
    condition: selection
falsepositives:
    - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high

Not validated

Telemetry required to run: azure; auditlogsazure / auditlogsazure

False positive: When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

title: Entra ID - Kullanici Tarafindan OAuth Uygulamasina Izin Verildi id: e7c1f6a4-28b9-4e3d-a5c8-1b4e7f9d2c36 status: experimental description: | Microsoft Entra ID denetim gunluklerinde bir kullanicinin OAuth uygulamasina onay verdigi olaylari tespit eder. Illicit consent grant saldirilarinda (T1528) saldirganlar kullanicilari zararli OAuth uygulamalarini yetkilendirmeye yonlendirir; bu sayede kullanicinin token'i olmadan kalici e-posta/dosya erisimi kazanirlar. Yuksek riskli izinler (Mail.Read, Files.ReadWrite.All vb.) iceren onaylar ozellikle suphelidir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1528/ - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/azure_illicit_oauth_grant.yml - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1528 - attack.credential_access logsource: product: azure service: auditlogs detection: selection_consent: OperationName: 'Consent to application' ResultType: 'success' selection_high_risk_permissions: TargetResources|contains: - 'Mail.Read' - 'Mail.ReadWrite' - 'Mail.Send' - 'Files.ReadWrite.All' - 'Directory.ReadWrite.All' - 'RoleManagement.ReadWrite.Directory' - 'AppRoleAssignment.ReadWrite.All' - 'Application.ReadWrite.All' - 'User.ReadWrite.All' - 'offline_access' filter_admin_consent: InitiatedBy|contains: 'Global Administrator' OperationName: 'Consent to application' AdditionalDetails|contains: 'adminConsent=True' condition: selection_consent and selection_high_risk_permissions and not filter_admin_consent falsepositives: - Btimsec veya IT yoneticileri tarafindan yetkilendirilen kurumsal uygulamalar - Microsoft 365 entegrasyonlari (Teams, SharePoint vb.) - Mesgru is uygulamalari ilk kurulum sirasinda genis izin isteyebilir level: high

title: Entra ID - Uygulama veya Servis Sorumlusuna Yeni Kimlik Bilgisi Eklendi id: f4a2d8c5-19e7-4f1b-b6d3-8c2e5a1f4b97 status: experimental description: | Microsoft Entra ID'de mevcut bir uygulamaya veya servis sorumlusuna (service principal) yeni sertifika veya client secret eklenmesini tespit eder. Bu eylem (T1528) saldirganin ele gecirdigi uygulamaya kalici erisim saglamak veya calinan OAuth token'i yenilemek icin kullanilir. Mesgru olmayan kimlik bilgisi ekleme islemleri, ozellikle is saatleri disinda veya yabanci IP'den yapilanlari, ciddi tehdit gostergesidir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1528/ - https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/azure_app_credential_added.yml - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1528 - attack.credential_access - attack.persistence logsource: product: azure service: auditlogs detection: selection_credential_added: OperationName|contains: - 'Add service principal credentials' - 'Update application – Certificates and secrets management' - 'Add application' ResultType: 'success' filter_known_devops: InitiatedBy|contains: - 'Azure DevOps' - 'GitHub Actions' - 'Terraform' - 'Managed Identity' condition: selection_credential_added and not filter_known_devops falsepositives: - Mesgru DevOps/CI-CD surecleri (GitHub Actions, Azure DevOps pipeline) uygulama sirri olusturabilir - Uygulama sertifika yenileme (yillik rutin) - BT yoneticileri tarafindan yapilan yetkilendirilmis degisiklikler level: medium

Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

HackTool - Koh Default Named Pipe

Mitigations

Audit

Cloud Access Security Broker (CASB)

OAuth and Application Consent Governance

Baseline controls against this technique

Response playbooks

Techniques in the Credential Access tactic

References

Anomalous Token

Anonymous IP Address

App Granted Microsoft Permissions

Application URI Configuration Changes

Entra ID Malicious OAuth Application Consent Grant

Entra ID Service Principal Credential Addition

Restrict Web-Based Content

User Account Management

User Training

Kerberos Ticket Attacks: From Kerberoasting to Ticket Forgery

NTLM Authentication Attacks: From Pass-the-Hash, NTLM Relay, and Forced Authentication to LLMNR/NBT-NS Poisoning

Azure / Entra ID Management Plane Compromise — Application Persistence, Role Takeover, and Golden SAML

Microsoft Graph API Unauthorized Consent and OAuth Consent Abuse Response

Azure / Entra ID Token and Credential Harvesting Response