Azure AD Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions

Alerts on Azure AD audit log entries where an app/service principal is granted delegated or app-role permissions to Microsoft services.

FreeUnreviewedSigmahighv1

azure-ad-audit-logs-app-granted-microsoft-graph-exchange-sharepoint-azure-ad-per-c1d147ae

title: "Azure AD Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions"
id: 398cd516-4ff8-464b-bc14-48f5198ca578
status: test
description: This rule flags Azure AD audit log events where an application is granted delegated permissions or app role assignments related to Microsoft Graph, Exchange, SharePoint, or Azure AD. Granting these permissions can enable an attacker to expand an app’s access to sensitive resources by authorizing new OAuth permissions to a service principal. It relies on audit log messages indicating delegated permission grants or app role assignments for the targeted Microsoft services.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-10
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Add delegated permission grant
      - Add app role assignment to service principal
  condition: selection
falsepositives:
  - When the permission is legitimately needed for the app
level: high
license: DRL-1.1
related:
  - id: c1d147ae-a951-48e5-8b41-dcd0170c7213
    type: derived

What it detects

This rule flags Azure AD audit log events where an application is granted delegated permissions or app role assignments related to Microsoft Graph, Exchange, SharePoint, or Azure AD. Granting these permissions can enable an attacker to expand an app’s access to sensitive resources by authorizing new OAuth permissions to a service principal. It relies on audit log messages indicating delegated permission grants or app role assignments for the targeted Microsoft services.

Known false positives

When the permission is legitimately needed for the app

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.