[terrancedejesus]

Summary

Separate PR building on the community contribution in #6729 by @earbona23, who is credited as a co-author on the rule. Same premise (non-admin consent to an app requesting high-risk delegated scopes), broadened from mailbox-only to the scope families adversaries actually request, with first-party false-positive handling. This PR supersedes #6729.

Logic changes

• Scope coverage expanded from Mail.* / MailboxSettings.ReadWrite to high-risk families: mail, mailbox settings/items/folders, contacts, files, SharePoint (Graph Sites.* plus SPO AllSites.* / MyFiles.*), OneNote, Teams chat, and Exchange EWS (EWS.AccessAsUser.All, full_access_as_user). Low-risk variants (Mail.ReadBasic, Chat.ReadBasic, Files.*.Selected) are excluded.
• Recon scopes (people, calendars, meetings, tasks, directory users, impersonation) tracked as a low-risk tier; alert only when an external app stacks 2+ with offline_access.
• App owner classification (Esql.app_owner_type: microsoft / tenant / external) from AppOwnerOrganizationId plus well-known first-party public-client AppIds. user_impersonation and Directory.AccessAsUser.All are ignored for Microsoft apps (Azure CLI / PowerShell / Portal / VS Code consent noise).
• Esql.sp_provisioned_by_consent flags first-time-seen apps (service principal created by the consent).
• Entra logs one consent event per resource API, so SPO / EWS / ARM scopes never share an event with offline_access. The offline_access gate now applies only to Graph families; sharepoint_spo and exchange_ews alert on their own.
• Fully row-level ES|QL (no STATS / MV_EXPAND); keeps _id / _version / _index and original field names. MV_CONTAINS requires min_stack_version = "9.3.0".
• Added Initial Access (T1566.002) mapping alongside T1528 to match the sibling illicit-consent rule; file and rule renamed to reflect the broadened scope. Description, false positives, and investigation guide updated for the new fields.

Related Research

Below are some references used to determine appropriate scopes to flag for this rule.

• Microsoft IR playbook: Mail.*, Contacts.*, MailboxSettings.*, People.*, Files.*, Notes.* appear in ~99% of observed consent phishing.
• Microsoft-managed consent policy (Aug / Nov 2025) now blocks user consent to Files, Sites, Mail, Chat, Calendars, and OnlineMeetings scopes.
• Red team tooling defaults: 365-Stealer, GraphRunner.
• Proofpoint TA2552, OiVaVoii, 2025 OAuth impersonation; Midnight Blizzard EWS abuse.

Validation

• validate-rule and tests/test_all_rules.py pass.
• Logic exercised against lab consent events: illicit-consent emulation apps (mail files teams_chat), PnP PowerShell (sharepoint_spo), an EWS full_access_as_user grant (exchange_ews); Graph CLI correctly suppressed.
• Still needs telemetry FP testing before marking ready for review.

[Copilot]

Copilot review overview

🟡 Changes recommended

Alert suppression can hide distinct consent grants, and required rule metadata should be corrected.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Add required ES|QL Rule Type taxonomy tag · New
• Include grant details in alert suppression key · New
• Condense description to two or three sentences · New

What changed in this PR

Adds an ES|QL rule detecting risky end-user OAuth consent grants in Microsoft Entra ID.

Changes:

• Detects high-risk delegated scopes and suspicious scope combinations.
• Classifies application ownership and service-principal provisioning.
• Adds investigation, false-positive, and remediation guidance.

File	Description
rules/​integrations/​azure/​initial_access_entra_id_end_user_consent_high_risk_scopes.toml	Defines the new consent detection rule and investigation guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.