Lion Cipher Lab

Detect illicit OAuth consent grants from identity logs (build the analytic from scratch)

• SOC Analyst / Blue Team
• Advanced
• ~75 min
• Free · no account required

Why it matters

Most persistence you learn to hunt lives on an endpoint: a service, a scheduled task, a registry run key — something EDR can see. An illicit OAuth consent grant lives nowhere near an endpoint. An attacker registers a multi-tenant OAuth application (or abuses one), phishes a user with a real, authentic-looking Microsoft consent screen, and the user clicks 'Accept' — granting the app delegated permissions like Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, and offline_access. That grant mints the attacker a refresh token. From that moment the attacker reads mail and files through the Graph API…

What you'll learn

• reading a Microsoft Entra ID (Azure AD) audit-log event and pulling out the fields that matter (activityDisplayName, ConsentType, ConsentAction.Permissions)
• understanding why an OAuth consent grant is a credential-less persistence path that survives a password reset and MFA — and why the identity audit log is the only witness
• classifying delegated OAuth scopes into risk tiers the way the Microsoft IR playbook does (Mail.*, Files.*, Contacts.* vs User.Read/offline_access)
• writing a from-scratch pandas analytic that combines scope-risk scoring, first-seen-app, unverified-publisher + multi-tenant, and a burst-across-users signal
• tuning out a benign SaaS-onboarding false positive with publisher verification and scope classification, and naming the failure modes (admin-consent blind spot, low-and-slow, scope aliasing, audit latency)

Steps in this lab

1. The attack: a consent grant is credential-less persistence
2. The only witness: the 'Consent to application' audit event
3. Generate a synthetic Entra audit log
4. Inspect the raw events before you trust any rule
5. Write the analytic: parse, then score
6. Run it and catch the grant
7. Tune out the benign onboarding — and name the failure modes
8. The judgment: why user consent gets restricted
9. Clean up

Open the full interactive lab →