HUNT 19 Consent Grant Burst
Query
// Hunt : Hunt - AAD App Consent Grant Burst (potential illicit consent attack)
// Tactics : Persistence, InitialAccess
// MITRE : T1528
// Purpose : Broad companion to RULE-18. Surfaces any initiator granting 5+ OAuth consents /
// permission grants within a single hour (any scope, not just high-impact). Use to
// baseline consent behaviour and to catch phishing waves where a single user is
// tricked into consenting to a cluster of malicious apps.
//==========================================================================================
let Window = 7d;
let GrantThreshold = 5;
AuditLogs
| where TimeGenerated > ago(Window)
| where OperationName has_any ("Consent to application", "Add delegated permission grant",
"Add app role assignment grant to user")
| where Result =~ "success"
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend AppName = tostring(TargetResources[0].displayName)
| where isnotempty(Initiator)
| summarize Grants = count(), Apps = make_set(AppName, 25), Operations = make_set(OperationName, 5)
by Initiator, bin(TimeGenerated, 1h)
| where Grants >= GrantThreshold
| order by Grants descExplanation
This query is designed to detect potential illicit consent attacks in Azure Active Directory (AAD) by identifying unusual patterns in OAuth consent grants. Here's a simplified explanation:
-
Purpose: The query aims to find instances where a user or application has granted five or more OAuth consents or permissions within a single hour. This behavior might indicate a phishing attack where a user is tricked into approving multiple malicious applications.
-
Time Frame: It looks at audit logs from the past seven days.
-
Operations Monitored: The query focuses on specific operations related to granting permissions, such as "Consent to application," "Add delegated permission grant," and "Add app role assignment grant to user."
-
Success Filter: Only successful operations are considered.
-
Initiator Identification: It identifies who initiated the consent, whether it was a user or an application.
-
Data Aggregation: For each initiator, it counts the number of consents given and lists the applications and operations involved, grouped by one-hour time bins.
-
Threshold Check: It filters the results to show only those initiators who have granted five or more consents in an hour.
-
Output: The results are ordered by the number of consents, showing the most active initiators first.
This query helps in establishing a baseline for normal consent behavior and detecting anomalies that could indicate security threats.
