// UMBRASEC sigma-pack - OAuth consent phishing (T1528), detection 2 of 3
// The moment a delegated permission grant is created via Microsoft Graph
// Source writeup: https://umbrasec.dev/research/detecting-oauth-consent-phishing.html
// Tuning: your own admins legitimately create grants during app onboarding.
// Scope this to actors outside your identity/app-admin roles, or correlate
// the source IP against known administrative networks.
MicrosoftGraphActivityLogs
| where RequestMethod == "POST"
| where RequestUri has "oauth2PermissionGrants"
| where ResponseStatusCode in (200, 201)
| project TimeGenerated, UserId, AppId, IPAddress, RequestUri, ResponseStatusCode
// Enrich UserId against your privileged-role list; grants from standard users
// - or from hosting / proxy ASNs - are the ones to surface.