// UMBRASEC sigma-pack - OAuth consent phishing (T1528), detection 3 of 3
// App-role (application permission) assignments - standing, user-independent access
// Source writeup: https://umbrasec.dev/research/detecting-oauth-consent-phishing.html
// Tuning: high-value app roles to flag by name include full_access_as_app
// (Exchange), Mail.ReadWrite, and any *.ReadWrite.All. These should be rare,
// deliberate, and reconciled against a change ticket.
AuditLogs
| where OperationName in ("Add app role assignment to service principal",
                          "Add app role assignment grant to user")
| where Result == "success"
| mv-expand TargetResources
| extend mods = TargetResources.modifiedProperties
| mv-expand mods
| extend propName = tostring(mods.displayName), newVal = tostring(mods.newValue)
| where propName in ("AppRole.Value", "ServicePrincipal.DisplayName")
| project TimeGenerated, OperationName,
          Actor = tostring(InitiatedBy.user.userPrincipalName), propName, newVal