Microsoft 365 malicious OAuth app
Activity involving a Microsoft 365 OAuth application that is commonly abused in business-email-compromise and consent-phishing (e.g. eM Client…
What it detects
Activity involving a Microsoft 365 OAuth application that is commonly abused in business-email-compromise and consent-phishing (e.g. eM Client, PerfectData Software, Newsletter Software SuperMailer, rclone). Attackers get a victim or admin to consent to one of these apps — or add it as a service principal — for durable mailbox/file access that survives a password reset and bypasses MFA. Matches the app's display name in consent/service-principal records and known app ids in access records (see knowledge/malicious-oauth-apps.yaml).
MITRE ATT&CK mapping
False positives and triage
A few of these apps have legitimate uses in some organizations. The signal is consent to, or access by, one of these apps by an account that has never used it, right after a suspicious sign-in, or with high-privilege mail/file scopes. Confirm the app is expected for that user and revoke it if not.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_malicious_oauth_app.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_malicious_oauth_app
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1528, T1550.001]
description: |
Activity involving a Microsoft 365 OAuth application that is commonly abused in
business-email-compromise and consent-phishing (e.g. eM Client, PerfectData
Software, Newsletter Software SuperMailer, rclone). Attackers get a victim or
admin to consent to one of these apps — or add it as a service principal — for
durable mailbox/file access that survives a password reset and bypasses MFA.
Matches the app's display name in consent/service-principal records and known app
ids in access records (see knowledge/malicious-oauth-apps.yaml).
match:
provider: Office365
raw_message_contains_any:
- "eM Client"
- "PerfectData Software"
- "PERFECTDATA SOFTWARE"
- "Newsletter Software SuperMailer"
- "CloudSponge"
- "app_id=e9a7fea1-1cc0-4cd9-a31b-9137ca5deedd"
- "app_id=b15665d9-eda6-4092-8539-0eec376afd59"
correlation_keys: [user_name]
false_positive_guidance: |
A few of these apps have legitimate uses in some organizations. The signal is
consent to, or access by, one of these apps by an account that has never used it,
right after a suspicious sign-in, or with high-privilege mail/file scopes. Confirm
the app is expected for that user and revoke it if not.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.