OAuth Consent Traps, CEO Social-Engineering Kits, and 5,000 Dropbox Account Hacks: A Defender's Detection and Response Playbook

---
title: OAuth Consent Grant to Application (Potential Illicit Consent)
id: 3f8a2b14-9c6e-4d71-a52b-8e1f4c7d9a03
status: experimental
description: Detects user or admin consent grants to OAuth applications in Entra ID. Consent phishing campaigns trick users into granting malicious apps persistent mailbox and file access. Tune against known approved enterprise applications.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.credential_access
  - attack.persistence
  - attack.t1550.001
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add delegated permission grant'
      - 'Add app role assignment to service principal'
  filter_known_apps:
    InitiatedBy|contains:
      - 'admin@yourdomain.tld'
  condition: selection and not filter_known_apps
falsepositives:
  - Legitimate user consent to approved SaaS applications where user consent is still enabled
  - Administrators onboarding new enterprise applications
level: medium
---
title: Office or Browser Process Spawning Script Interpreter (Phish Payload Execution)
id: 6c1d9e47-2a83-4f55-b3d0-5e8a7c2f1b94
status: experimental
description: Detects Office applications, browsers, or email clients spawning script interpreters — a common execution stage after a user opens a lure document or follows a link delivered via trusted file-sharing platforms such as compromised Dropbox shares.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser-launched installers and legitimate Office add-ins (rare); baseline per parent process
level: high
---
title: DNS Query for Dropbox Typosquat or Lookalike Domain
id: 9b4e7c21-5d38-4a90-e6f2-1c3a8d5b7f60
status: experimental
description: Detects DNS resolutions matching common Dropbox typosquatting and lookalike patterns used by credential-harvesting pages. Excludes the legitimate dropbox.com namespace.
references:
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'dropbox-'
      - '-dropbox'
      - 'dr0pbox'
      - 'dropb0x'
      - 'drobpox'
      - 'dropboxlogin'
      - 'dropboxverify'
  filter_legitimate:
    query|endswith:
      - 'dropbox.com'
      - 'dropbox-dns.com'
      - 'dropboxapi.com'
  condition: selection and not filter_legitimate
falsepositives:
  - Security research or brand-protection scanning infrastructure
level: medium

// Hunt 1: Suspicious OAuth consent grants with high-risk scopes (consent phishing)
let RiskyScopes = dynamic(["Mail.Read","Mail.ReadWrite","Mail.Send","offline_access","Files.Read.All","Files.ReadWrite.All","User.Read.All","full_access_as_app","EWS.AccessAsUser.All","Contacts.Read","MailboxSettings.ReadWrite"]);
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("Consent to application","Add delegated permission grant")
| mv-apply TargetResource = TargetResources on (
    extend AppName = tostring(TargetResource.displayName),
           Scopes = tostring(TargetResource.modifiedProperties)
)
| extend Grantor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| where Scopes has_any (RiskyScopes)
| project TimeGenerated, OperationName, AppName, Grantor, Scopes, CorrelationId, Result
| order by TimeGenerated desc;
// Hunt 2: Token-theft style sign-ins — new ASN/device for accounts accessing file-sharing apps
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("Dropbox","OneDrive","SharePoint")
| summarize SignInCount = count(),
            DistinctASNs = dcount(NetworkLocationDetails),
            IPs = make_set(IPAddress),
            Locations = make_set(LocationDetails),
            Devices = make_set(DeviceDetail)
  by UserPrincipalName, AppDisplayName
| where array_length(IPs) > 3 or SignInCount > 50
| order by SignInCount desc;
// Hunt 3: Endpoint execution — browser/Office spawning script interpreters
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","msedge.exe","chrome.exe","firefox.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

-- Hunt for script interpreters launched with remote URLs or executed from user-writable staging paths
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
    (Name =~ '(?i)mshta|rundll32|regsvr32|powershell|wscript|cscript'
     AND CommandLine =~ '(?i)http[s]?://')
    OR Exe =~ '(?i)(Downloads|AppData\\\\Local\\\\Temp|ProgramData)'
)
ORDER BY CreateTime DESC

# OAuth Consent Audit & Hardening for Entra ID (requires Microsoft.Graph module, ConsentPolicy.ReadWrite.All)
# Step 1: Connect with least-privilege scopes needed for audit + policy update
Connect-MgGraph -Scopes "Application.Read.All","DelegatedPermissionGrant.ReadWrite.All","Policy.ReadWrite.PermissionGrant","Directory.Read.All"

# Step 2: Inventory all delegated permission grants and flag risky scopes
$RiskyScopes = @("Mail.Read","Mail.ReadWrite","Mail.Send","offline_access","Files.Read.All","Files.ReadWrite.All","User.Read.All","full_access_as_app","EWS.AccessAsUser.All","MailboxSettings.ReadWrite")
$grants = Get-MgOauth2PermissionGrant -All
foreach ($g in $grants) {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
    $matched = $RiskyScopes | Where-Object { $g.Scope -match [regex]::Escape($_) }
    if ($matched) {
        [PSCustomObject]@{
            AppDisplayName = $sp.DisplayName
            AppId          = $sp.AppId
            ConsentType    = $g.ConsentType
            RiskyScope     = ($matched -join ",")
            AllScopes      = $g.Scope
            GrantId        = $g.Id
            Publisher      = $sp.PublisherName
            VerifiedPublisher = $sp.VerifiedPublisher.DisplayName
        }
    }
} | Format-Table -AutoSize
# Review the output: any unverified publisher, unfamiliar app name, or recent grant timestamp is a suspect.

# Step 3: Revoke a malicious grant (replace with the GrantId from Step 2 output)
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<GRANT_ID>"
# Also revoke the user's refresh tokens to kill active attacker sessions:
# Revoke-MgUserSignInSession -UserId "<USER_OBJECT_ID>"

# Step 4: Disable end-user consent so only admins can approve apps going forward
Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId "authorizationPolicy" `
  -BodyParameter @{ defaultUserRolePermissions = @{ permissionGrantPoliciesAssigned = @() } }
# Verify: Entra portal > Enterprise applications > Consent and permissions > User consent settings
# should now read "Do not allow user consent" or "Allow consent for verified publishers, low-risk scopes only"

# Step 5: Audit for persistence planted via compromised mailboxes
$users = Get-MgUser -All -Property Id,UserPrincipalName
foreach ($u in $users) {
    Get-MgUserMailFolderMessageRule -UserId $u.Id -MailFolderId "inbox" -ErrorAction SilentlyContinue |
      Where-Object { $_.Actions.ForwardTo -or $_.Actions.ForwardAsAttachmentTo -or $_.Actions.RedirectTo } |
      Select-Object @{n="User";e={$u.UserPrincipalName}}, DisplayName, IsEnabled, Actions
}
# Investigate any rule forwarding to external addresses — classic BEC persistence.