Azure AD end-user consent blocked for risky apps by risk-based consent

title: Azure AD end-user consent blocked for risky apps by risk-based consent
id: 8f301b21-31c9-45b5-a8c9-18021752d3c0
status: test
description: This rule flags Azure audit log events where end-user consent is blocked due to risk-based consent. Attackers may attempt to grant themselves access by persuading users to consent to risky applications, so blocking consent reduces credential-access and authorization abuse. It relies on Azure audit log telemetry capturing the specific failure status reason indicating consent was blocked for risky apps exceptions.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-stopped-due-to-risk-based-consent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-10
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    failure_status_reason: Microsoft.online.Security.userConsentBlockedForRiskyAppsExceptions
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7091372f-623c-4293-bc37-20c32b3492be
    type: derived