Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ChecklistCONSTRUCTEDUntestedMembers

First 15 minutes: somebody consented to an application nobody recognises

A consent grant with mail or file access keeps working after every password reset, because it never meets a login prompt. Read what was granted, cut it off without destroying it, and find everyone else who clicked Accept.

high severityCredential AccessT1528T1550.001

The clock starts when

A user or an administrator granted consent to an application nobody recognises, particularly one asking for mail, files, or offline access.

  1. minutes 0 to 5Read exactly what was granted3 lines, 1 where evidence expires
  2. minutes 5 to 10Cut it off, keep the evidence3 lines
  3. minutes 10 to 15Find what it did with the access2 lines

sources

  1. Microsoft Learn: app consent grant investigation playbook · primary
  2. Microsoft Learn: configure how users consent to applications
  3. MITRE ATT&CK T1528, Steal Application Access Token

Tags: first-15 · oauth · consent · m365 · entra-id · cloud · T1528 · T1550.001