TH1.13 The Hunt-to-Detection Pipeline: Worked End-to-End

The worked example: OAuth consent phishing

This example follows the Hunt Cycle from start to finish. It is drawn from the same technique domain as TH6 (OAuth Application and Consent Abuse) but condensed to demonstrate the methodology, not the full campaign depth.

Step 1: Hypothesize

Source: Microsoft Security Blog — “Midnight Blizzard conducts targeted social engineering over Microsoft Teams” (August 2023). The report describes consent phishing via Teams messages, where the attacker persuades a user to consent to an OAuth application with high-privilege delegated permissions.

Hypothesis: “If an attacker used consent phishing to gain persistent access, AuditLogs will contain ‘Consent to application’ operations granting Mail.ReadWrite or Files.ReadWrite.All delegated permissions from non-admin users in the last 90 days.”

Quality check: Specific (names technique, data source, indicator). Testable (AuditLogs is ingested). Grounded (TI report from Microsoft). Actionable (if confirmed, revoke consent and investigate; if refuted, deploy detection rule and document).

Step 2: Scope

Data sources: AuditLogs (consent events), AADServicePrincipalSignInLogs (post-consent app behavior). Time window: 90 days (consent phishing may have occurred months ago; the application persists until revoked). Population: Full tenant (consent phishing targets any user, not just privileged accounts). Success criteria — positive: User-consented application with Mail.ReadWrite or Files.ReadWrite.All from a non-IT user, where the application is not a recognized productivity tool. Success criteria — negative: Full tenant examined across 90 days, no unrecognized high-privilege user-consented applications found.

Step 3: Collect

Query 1 — Orientation: How many consent events in 90 days?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// Q1: Orientation — consent event volume
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName == "Consent to application"
| where Result == "success"
| summarize TotalConsents = count(),
    UniqueApps = dcount(tostring(TargetResources[0].displayName)),
    UniqueUsers = dcount(tostring(InitiatedBy.user.userPrincipalName))
// Result: 347 consents, 42 unique apps, 189 unique users
// Assessment: expected volume for a mid-sized org

Query 2 — Indicator: Filter to high-privilege delegated permissions.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// Q2: Indicator — high-privilege consent events
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName == "Consent to application"
| where Result == "success"
| extend AppName = tostring(TargetResources[0].displayName)
| extend ConsentedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend Permissions = tostring(TargetResources[0].modifiedProperties)
| where Permissions has_any (
    "Mail.ReadWrite", "Files.ReadWrite.All",
    "Mail.Send", "Directory.ReadWrite.All")
| project TimeGenerated, ConsentedBy, AppName, Permissions
// Result: 12 consent events with high-privilege permissions

Query 3 — Refinement: Exclude known IT/admin users.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

// Q3: Refinement — exclude IT department
// 12 results from Q2 → filter out IT staff
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName == "Consent to application"
| where Result == "success"
| extend AppName = tostring(TargetResources[0].displayName)
| extend ConsentedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend Permissions = tostring(TargetResources[0].modifiedProperties)
| where Permissions has_any (
    "Mail.ReadWrite", "Files.ReadWrite.All",
    "Mail.Send", "Directory.ReadWrite.All")
| where ConsentedBy !endswith "@northgateeng.com"
    or ConsentedBy !in ("admin@northgateeng.com",
    "it-service@northgateeng.com")
// Exclude known admin accounts
// Result: 4 consent events from non-IT users

Query 4 — Enrichment: What are these 4 applications?

The analyst examines each:

1. Grammarly — recognized productivity tool. Legitimate.
2. Adobe Acrobat — recognized. Legitimate.
3. Zoom — recognized. Legitimate.
4. “DocuHelper Pro” — not recognized. Consented by l.chen@northgateeng.com on 2026-02-15. Permissions: Mail.ReadWrite, Files.ReadWrite.All.

Query 5 — Pivot: What did “DocuHelper Pro” do after consent?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// Q5: Pivot — post-consent behavior for suspect app
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(90d)
| where ServicePrincipalName == "DocuHelper Pro"
| summarize
    SignInCount = count(),
    UniqueIPs = dcount(IPAddress),
    IPs = make_set(IPAddress, 5),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
// Result: 847 sign-ins from 3 IPs since consent date
// IPs resolve to: US residential proxy, Netherlands VPS, Singapore VPS
// Sign-in pattern: continuous, 24/7, not human-driven
// Assessment: This is not a legitimate productivity tool

Step 4: Analyze

Enrichment across five dimensions for “DocuHelper Pro”:

User context: l.chen is a marketing coordinator. No legitimate reason to consent to a mail/file access application not on the approved list.

Temporal: Consent occurred 2026-02-15 at 10:23 UTC. Check EmailEvents — a Teams message from an external sender was received at 09:45 UTC on the same day containing a consent link. The 38-minute gap between message delivery and consent is consistent with social engineering.

Geographic: Post-consent sign-ins from 3 countries (US, Netherlands, Singapore) on residential proxy and VPS infrastructure. Not l.chen’s sign-in pattern.

Behavioral: 847 sign-ins over 43 days. Continuous, automated access. Mail.ReadWrite permission means the application has been reading all of l.chen’s email for 43 days.

Correlated: 4 dimensions indicate compromise. Confidence: High.

Step 5: Conclude

Outcome: Confirmed. “DocuHelper Pro” is a malicious OAuth application that has been reading l.chen’s email for 43 days via consented Mail.ReadWrite permissions, following a consent phishing attack delivered via Teams.

Escalation package: Finding (l.chen compromised via OAuth consent phishing, 43-day dwell time), evidence (consent event, Teams message, 847 automated sign-ins from 3 proxy IPs), recommended containment (revoke application consent, revoke l.chen’s sessions, reset password, review all email sent and received during the 43-day window, check for data exfiltration or BEC activity from the account).

Dwell time compression: The application was active for 43 days. No detection rule existed for this technique. Without hunting, the compromise would have continued indefinitely until the application was discovered through a separate investigation or the attacker achieved their objective.

Step 6: Convert

The step 2 query (high-privilege consent from non-admin users), with exclusions for the three known legitimate applications (Grammarly, Adobe, Zoom), becomes a Sentinel analytics rule:

Rule name: HUNT-TH6-001: High-privilege OAuth consent by non-admin user Frequency: Every 4 hours, 6-hour lookback Exclusions: Known apps on allowlist (Grammarly, Adobe Acrobat, Zoom, Microsoft To-Do) Entity mapping: Account (ConsentedBy), Application (AppName) Severity: Medium (single indicator — consent event; escalate to High if post-consent SPN sign-in anomalies detected) Deployed: Report-only for 14 days, then promoted to production.

Figure TH1.13 — Complete Hunt Cycle worked example. Six steps, five queries, one compromise found, one detection rule deployed. The technique moves from unmonitored to automated detection in a single campaign.

References Used in This Subsection

• Microsoft Threat Intelligence. “Midnight Blizzard conducts targeted social engineering over Microsoft Teams.” Microsoft Security Blog, August 2023.
• MITRE ATT&CK Techniques referenced: T1098.003 (Account Manipulation: Additional Cloud Roles)