Azure AD Audit Logs: End-User Consent to Application

Identifies end-user consent grants to applications in Azure AD audit logs.

FreeUnreviewedSigmalowv1

azure-ad-audit-logs-end-user-consent-to-application-9b2cc4c4

title: "Azure AD Audit Logs: End-User Consent to Application"
id: cef75b5d-e7f1-4826-b4e8-22b46a652008
status: test
description: This rule flags events in Azure audit logs where an end user grants consent to an application (ConsentContext.IsAdminConsent is false). User-consent flows can enable attackers to have an application granted access through legitimate authorization mechanisms. Detection relies on the audit log field indicating whether the consent was end-user versus admin consent.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-28
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    ConsentContext.IsAdminConsent: "false"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a
    type: derived

What it detects

This rule flags events in Azure audit logs where an end user grants consent to an application (ConsentContext.IsAdminConsent is false). User-consent flows can enable attackers to have an application granted access through legitimate authorization mechanisms. Detection relies on the audit log field indicating whether the consent was end-user versus admin consent.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.