ChatGPT in your inbox? Investigating Entra apps that request...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://redcanary.com/blog/threat-detection/entra-id-oauth-attacks/
• Blog Title: ChatGPT in your inbox? Investigating Entra apps that request unexpected permissions
• Suggested Section: Azure Pentesting -> Az - Entra ID (AzureAD) & Azure IAM (or Az - Tokens & Public Applications) -> OAuth consent phishing / oAuth2PermissionGrant persistence & investigation (AuditLogs correlation + Graph PowerShell remediation)

🎯 Content Summary

Title / topic
The post explains how OAuth consent in Microsoft Entra ID (Azure AD) can be abused (commonly via social engineering / consent phishing) to grant a third-party application persistent delegated access to Microsoft 365 data (e.g., mail) without needing to “break” authentication. It then provides a hands-on, log-driven workflow to observe, detect, investigate, remediate, and mitigate these events using Log Analytics AuditLogs and **Microsoft Graph PowerShel...

🔧 Technical Details

OAuth consent abuse trick (Entra ID / Azure AD): an attacker convinces a user to approve an OAuth consent prompt for a third-party app, resulting in an oAuth2PermissionGrant that allows token issuance for delegated Graph scopes (e.g., Mail.Read plus offline_access for long-lived access). This persists independently of password changes until the grant and/or service principal is removed. Detection can focus on AuditLogs where ConsentAction.Permissions.newValue begins with [] => (new grant), ConsentContext.IsAdminConsent=False (non-admin consent), and the scopes include commonly abused permissions; then correlate with Add service principal by matching CorrelationId to confirm the app was newly introduced.

Investigation parsing trick: treat TargetResources[0].modifiedProperties['ConsentAction.Permissions'].newValue as a serialized oAuth2PermissionGrant and parse out Id (grant ID to revoke), ClientId / TargetResources[0].id (service principal object ID ...

🤖 Agent Actions

ERROR: Codex CLI executable was not found.
Configured path: 'codex'.
Install Codex CLI (e.g. npm i -g @openai/codex) or set CODEX_PATH to the absolute executable path.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 582
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://redcanary.com/blog/threat-detection/entra-id-oauth-attacks/

Content Categories: Based on the analysis, this content was categorized under "Azure Pentesting -> Az - Entra ID (AzureAD) & Azure IAM (or Az - Tokens & Public Applications) -> OAuth consent phishing / oAuth2PermissionGrant persistence & investigation (AuditLogs correlation + Graph PowerShell remediation)".

Repository Maintenance:

• MD Files Formatting: 582 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0