AzureConsentLab

A purple-team lab for the OAuth Illicit Consent Grant attack in Microsoft Entra ID (MITRE ATT&CK T1528).

End-to-end walkthrough of the attack against an isolated Altered Security CARTP tenant, paired with Microsoft Sentinel detections and a set of prevention controls mapped to the Microsoft Cloud Security Benchmark and CIS Microsoft Azure Foundations Benchmark v2.1.

Built as a portfolio piece for cloud security engineering and GRC roles. Author: Syed Muhammad Saqlain (dx73r).

Start here: writeup.md. The rest of the repository is the executable evidence that backs it up, added phase by phase.

Ethics. Everything documented here was performed inside an isolated Altered Security training tenant. Running the same techniques against a tenant you do not own is unauthorised access under the UK Computer Misuse Act 1990 and equivalent legislation elsewhere. See SECURITY.md.

---

Why this matters

The Illicit Consent Grant attack does not require a vulnerability, a CVE, or a credential. The victim signs in to the real login.microsoftonline.com, sees a real Microsoft consent screen, and clicks Accept. The attacker walks away with an access token and a 90-day refresh token. Passwords, MFA, and every URL-bar check the user was trained to perform all pass cleanly.

Microsoft's own January 2024 breach (Midnight Blizzard) used this class of persistence. Most tenants leave the relevant consent settings at their permissive defaults.

---

Attack in five lines

1. Attacker registers a multi-tenant app in their own Entra ID tenant with delegated Graph permissions the user can consent to without admin approval (User.Read, User.ReadBasic.All, and offline_access for a refresh token).
2. Attacker sends the victim a link to the real login.microsoftonline.com OAuth authorize endpoint with the attacker's client_id and redirect_uri.
3. Victim authenticates to Microsoft, sees a real Microsoft consent screen, clicks Accept.
4. Entra ID redirects the victim's browser to the attacker's redirect URI with an authorisation code.
5. Attacker exchanges the code for an access token and a refresh token, then calls Microsoft Graph as the victim for up to 90 days without ever seeing the password or triggering MFA.

Full walkthrough in writeup.md.

---

What's included

• Attack writeup (writeup.md) covering the full CARTP lab reproduction with annotated screenshots.
• Microsoft Sentinel detections in detections/: five analytics rules and four hunting queries in KQL, ready to paste into the Analytics or Hunting blade.
• Prevention and hardening controls in writeup.md §11, each mapped to a Microsoft Cloud Security Benchmark control and to CIS Microsoft Azure Foundations Benchmark v2.1 where relevant.

Stretch goal (not committed): a small Python audit CLI on top of Microsoft Graph that flags risky consents in any tenant. May land as a follow-up.

---

Detections

Five Microsoft Sentinel analytics rules in detections/analytics-rules.md and four hunting queries in detections/hunting-queries.md. Together they cover the full attack chain from consent event to post-consent Graph abuse. Each rule and hunt is presented with its KQL, data source, MITRE mapping, entity mappings, and tuning notes, ready to paste into the Sentinel Analytics or Hunting blade.

---

Tech stack

• Cloud: Microsoft Entra ID, Microsoft 365, Microsoft Graph
• Detection: Microsoft Sentinel, Microsoft Defender for Cloud Apps, KQL
• Hardening: Entra ID portal settings, Conditional Access, Microsoft.Graph PowerShell
• Compliance frameworks: MCBS v1, CIS Microsoft Azure Foundations Benchmark v2.1

---

If you found this useful, I would rather hear about it than get a star. Feedback and hiring conversations equally welcome.