MITRE ATT&CK Technique
T1550.001
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Oauth Token Used From Novel Country
OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.
-
Hunting
Hunt Suspicious User Consented Oauth App Grants
'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.