MITRE ATT&CK Technique
T1098.003
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Hunting
Hunt Suspicious User Consented Oauth App Grants
'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.
-
Identity
Whos Activating Roles Via PIM
PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.