Microsoft 365 high privilege consent
An OAuth application was consented to (or granted) HIGH-PRIVILEGE Microsoft Graph permissions — mailbox, files, or directory read/write, or app-only…
What it detects
An OAuth application was consented to (or granted) HIGH-PRIVILEGE Microsoft Graph permissions — mailbox, files, or directory read/write, or app-only access. Illicit consent grants ("consent phishing") give an attacker-controlled app durable, user-independent access to mail and files that bypasses password resets and MFA; app-only scopes like full_access_as_app are especially dangerous.
MITRE ATT&CK mapping
False positives and triage
Legitimate apps request these scopes too. The signal is consent to an unfamiliar app, app-only (application) permissions, or consent right after a suspicious sign-in / a consent-phishing lure. Review the app, who consented, and whether it was admin consent (tenant-wide) — tenant-wide grants are the most dangerous.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_high_privilege_consent.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_high_privilege_consent
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1528, T1550.001]
description: |
An OAuth application was consented to (or granted) HIGH-PRIVILEGE Microsoft Graph
permissions — mailbox, files, or directory read/write, or app-only access. Illicit
consent grants ("consent phishing") give an attacker-controlled app durable,
user-independent access to mail and files that bypasses password resets and MFA;
app-only scopes like full_access_as_app are especially dangerous.
match:
provider: Office365
event_action_any:
- "Consent to application."
- "Add delegated permission grant."
- "Add app role assignment grant to user."
- "Add OAuth2PermissionGrant."
raw_message_contains_any:
- "Mail.Read"
- "Mail.ReadWrite"
- "Mail.Send"
- "MailboxSettings.ReadWrite"
- "Files.ReadWrite.All"
- "Files.Read.All"
- "Directory.ReadWrite.All"
- "Application.ReadWrite.All"
- "full_access_as_app"
- "offline_access"
correlation_keys: [target_user_name]
false_positive_guidance: |
Legitimate apps request these scopes too. The signal is consent to an unfamiliar
app, app-only (application) permissions, or consent right after a suspicious
sign-in / a consent-phishing lure. Review the app, who consented, and whether it
was admin consent (tenant-wide) — tenant-wide grants are the most dangerous.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.