Entra ID Illicit Consent Grant via Registered Application

hello@craftedsignal.io — Wed, 03 Jan 2024 18:23:00 +0000

Attackers are increasingly leveraging illicit consent grants within Microsoft Entra ID to gain unauthorized access to sensitive data. This involves registering a malicious application within an organization's Entra ID environment and tricking users into granting it excessive permissions via OAuth consent. The attack commonly uses spearphishing to distribute links that lead users to grant permissions to seemingly legitimate applications. Once consent is granted, the attacker-controlled application can access resources like mail, profiles, and files on behalf of the compromised user. Detection focuses on identifying unusual consent activity within Azure audit logs, particularly new application consent grants and instances where Microsoft flags an application as risky. This activity is flagged using ES|QL aggregation logic over a 7-day window looking for new or risky user-application consent pairs.

Attack Chain

The attacker registers a malicious application within Microsoft Entra ID.
The attacker crafts a spearphishing email containing a malicious link.
The victim receives the spearphishing email and clicks the malicious link.
The link redirects the victim to a consent page for the attacker's application.
The consent page requests permissions to access resources such as mail, profiles, and files.
The victim, believing the application is legitimate, grants consent.
The attacker's application receives an OAuth access token.
The attacker's application uses the access token to access resources on behalf of the compromised user, enabling data exfiltration or other malicious activities.

Impact

A successful illicit consent grant attack can lead to unauthorized access to sensitive data, including emails, files, and user profiles. The impact includes data breaches, financial loss, and reputational damage. While the exact number of victims is unknown, this technique targets any organization using Microsoft Entra ID and relying on user consent for application access.

Recommendation

Deploy the Sigma rule Detect Entra ID Illicit Consent Grant to your SIEM and tune for your environment to detect suspicious consent grants.
Review Azure audit logs for consent events where the azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value field contains "Risky application detected".
Enable the Admin Consent Workflow in Azure AD to prevent unsanctioned user approvals.
Revoke the OAuth grant for any identified malicious application using Graph API or PowerShell.

Entra ID Sharepoint or OneDrive Accessed by Unusual Client

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies when an application accesses SharePoint Online or OneDrive for Business for the first time within a tenant. This is a critical signal for detecting successful OAuth phishing campaigns, where users are tricked into granting consent to malicious applications. Once consent is granted, the malicious app can persistently access file storage without further user interaction. This also catches illicit consent grants, compromised third-party applications, or custom malicious apps registered by adversaries. The rule uses data from Entra ID sign-in logs to identify new application IDs accessing SharePoint or OneDrive resources. The rule looks back 9 months to establish a baseline of known applications.

Attack Chain

The attacker sends a phishing email with a link to a malicious OAuth application.
The victim clicks the link and is redirected to a legitimate-looking consent page.
The victim grants consent to the malicious application, unknowingly providing access to their data.
The malicious application authenticates to Entra ID using the granted consent.
The application accesses SharePoint Online or OneDrive for Business using the victim's permissions.
The application exfiltrates sensitive data from SharePoint or OneDrive.
The attacker uses the exfiltrated data for their objectives, such as financial gain or espionage.

Impact

A successful OAuth phishing campaign or illicit consent grant can lead to significant data breaches. An attacker gaining access to SharePoint Online or OneDrive for Business can steal sensitive documents, intellectual property, and other confidential information. This can result in financial losses, reputational damage, and legal liabilities. There is no specific number of victims or sectors targeted detailed in the provided source material.

Recommendation

Deploy the Sigma rule "Entra ID Sharepoint or OneDrive Accessed by Unusual Client" to your SIEM and tune for your environment to detect initial access of unusual applications.
Review azure.signinlogs.properties.app_id and azure.signinlogs.properties.app_display_name to identify the application and cross-reference with known legitimate applications, as described in the rule's Triage and Analysis section.
Monitor azure.auditlogs for recent Consent to application events matching suspicious app IDs to identify how consent was granted, as documented in the rule's analysis section.
Implement Conditional Access policies to require admin consent for high-risk permissions and block unverified publishers, as recommended in the Response and Remediation section.
Ensure that Microsoft Entra ID Sign-In Logs are being collected and streamed into the Elastic Stack via the Azure integration, as required by the rule setup.

Illicit-Consent - CraftedSignal Threat Feed

Entra ID Illicit Consent Grant via Registered Application

Attack Chain

Impact

Recommendation

Entra ID Sharepoint or OneDrive Accessed by Unusual Client

Attack Chain

Impact

Recommendation