OAuth consent change followed by first-seen OAuthAppId burst — Solutions Analyzer

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Detects consent or application permission grant changes followed by first-seen CloudAppEvents bursts for OAuth apps.

Attribute	Value
Type	Hunting Query
Solution	Hybrid Attack - Cloud & Identity
ID	`10faf58e-d006-482f-87f0-a95b019cbf6f`
Tactics	InitialAccess, Discovery, Collection
Techniques	T1550.001, T1528, T1087.004
Required Connectors	AzureActiveDirectory, MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
`CloudAppEvents`	✓	✗	✓

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Hybrid Attack - Cloud & Identity