ConsentFix v3: Detecting and Mitigating Automated Azure OAuth Abuse

---
title: Azure AD High-Risk OAuth Consent Granted
id: 8f4d9e21-7a6c-4b3d-9c1e-2f5a8b9c0d1e
status: experimental
description: Detects when a user consents to an application requesting high-risk permissions, indicative of ConsentFix or illicit consent grants.
references:
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2025/02/18
tags:
  - attack.initial_access
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName|contains: 'Consent to application'
  filter_high_risk:
    TargetResources|contains:
      - 'User.Read.All'
      - 'Mail.Read.All'
      - 'Mail.ReadWrite'
      - 'Sites.Read.All'
      - 'Files.Read.All'
      - 'RoleManagement.ReadWrite.Directory'
  condition: selection and filter_high_risk
falsepositives:
  - Legitimate application registration by authorized administrators
level: high
---
title: Azure AD Service Principal Created via Risky Multi-Tenant App
id: 7c3e1a99-5b8d-4e2f-9a0b-1e4d5c6f7a8b
status: experimental
description: Detects the addition of a service principal from a multi-enant application, often used in ConsentFix automation.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/audit-log-activity-reference
author: Security Arsenal
date: 2025/02/18
tags:
  - attack.persistence
  - attack.t1136.003
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName|contains:
      - 'Add service principal'
      - 'Add appRoleAssignment to service principal'
  filter_context:
    InitiatedBy|contains: 'Admin' # Filter out known admin accounts as noise reduction if needed, otherwise omit to catch all
    # Note: ConsentsFix v3 often creates SPs. We look for the 'Added' event.
  condition: selection
falsepositives:
  - Installation of legitimate SaaS applications by IT staff
level: medium

// Hunt for high-risk OAuth consent grants
AuditLogs
| where OperationName == "Consent to application"
| extend TargetApp = TargetResources[0].displayName
| extend Permissions = TargetResources[0].modifiedProperties
| mv-apply Permissions on 
  (where Permissions.displayName == "ConsentAction.Permissions")
| extend GrantedPermissions = tostring(Permissions.newValue)
| where GrantedPermissions has "User.Read.All" 
   or GrantedPermissions has "Mail.Read.All" 
   or GrantedPermissions has "Sites.Read.All" 
   or GrantedPermissions has "Files.Read.All"
| project TimeGenerated, Caller, CallerIpAddress, TargetApp, GrantedPermissions, Result
| order by TimeGenerated desc

-- Hunt for PowerShell processes utilizing Azure AD modules to register apps or consent
-- This detects the local execution of ConsentFix automation scripts on endpoints.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'powershell.exe'
  AND (
    CommandLine =~ 'Connect-AzureAD' 
    OR CommandLine =~ 'New-AzureADApplication' 
    OR CommandLine =~ 'Add-AzureADServicePrincipal' 
    OR CommandLine =~ 'Microsoft.Graph'
  )
  AND CommandLine !~ '@' 
-- Filter out common internal scripts to reduce noise

# Requires Microsoft.Graph PowerShell module installed
# Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

# Step 1: Disable user consent for all apps (Prevent ConsentFix v3 success)
$Params = @{
  PermissionGrantPolicyIdsAssignedToDefaultUserRole = @() 
}
Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId $authorizationPolicyId -BodyParameter $Params

Write-Host "[+] User consent has been disabled. Users can no longer grant permissions to apps."

# Step 2: Identify Service Principals with high-risk permissions added recently
$HighRiskPerms = @('User.Read.All', 'Mail.Read.All', 'Sites.Read.All', 'RoleManagement.ReadWrite.Directory')
$DateCutoff = (Get-Date).AddDays(-30)

Get-MgServicePrincipal -All | Where-Object {
    $_.AppRoles | Where-Object { $_.AllowedMemberTypes -contains 'User' -and $_.DisplayName -in $HighRiskPerms }
} | ForEach-Object {
    Write-Host "[!] Reviewing High-Risk Service Principal: $($_.DisplayName) (AppId: $($_.AppId))"
    # Note: Manually review output before deletion.
}

Write-Host "[!] Review listed Service Principals. Remove malicious ones using: Remove-MgServicePrincipal -ServicePrincipalId <ID>"