Skip to content
cccskills
FreePublished on GitHub

Tespit etme-suspicious-oauth-application-consent

tespit etmerisky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

The English summary is being prepared. Showing the original description.

Works withAzure
See how to install

Files included (1)

  • SKILL.md2.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Detection Suspicious Oauth Application Consent

Genel Bakış

Illicit consent grant attacks trick users into granting excessive permissions to malicious OAuth applications in Azure AD / Microsoft Entra ID. bu skill uses the Microsoft Graph API to enumerate OAuth2 permission grants, analyze application permissions for overly broad scopes, review directory audit logs for consent events, and flag high-risk applications based on publisher verification status and permission scope.

Ne Zaman Kullanılır

  • investigating yaparken security incidents that require Tespit etme suspicious oauth application consent
  • building yaparken Tespit rules or threat hunting queries for this domain
  • SOC yaparken: analysts need structured procedures for this analysis type
  • validating yaparken security monitoring coverage for related attack techniques

Ön Gereksinimler

  • Azure AD / Entra ID tenant with Global Reader or Security Reader role
  • Microsoft Graph API access with Application.Read.All, AuditLog.Read.All, Directory.Read.All
  • Python 3.9+ with msal, requests
  • App registration with client secret or certificate for authentication

Adımlar

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Enumerate all OAuth2 permission grants via /oauth2PermissionGrants
  3. List service principals and their assigned application permissions
  4. Query directory audit logs for Consent to application events
  5. Flag applications with high-risk scopes (Mail.Read, Files.ReadWrite.All, etc.)
  6. Check publisher verification status for each application
  7. Generate risk report with remediation recommendations

Expected Output

  • JSON report listing all OAuth apps with granted permissions, risk scores, unverified publishers, and suspicious consent patterns
  • Audit trail of consent grant events with user and IP details
<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: dbf42b0e9cda6fa7 -->

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

21st.dev Magic MCP — AI-powered UI component generation via natural language. Access to 21st.dev component library, SVGL brand logos, and real-time preview. Generate React/Tailwind components with /ui command.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES CBC/ECB modlarına karşı kriptografik bütünlük saldırıları — bit flipping, IV manipulation, ECB cut-and-paste, CBC-MAC length extension, IV reuse

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES-GCM ve ChaCha20-Poly1305 nonce yeniden kullanımı saldırısı — GF(2^128) polinom kök bulma ile Hash Key kurtarma ve MAC sahteciliği.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

tespit etmeabnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly Tespit.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to tespit etmereentrancy, integer overflow, access control, and other vulnerability classes before Dağıt:ment to Ethereum mainnet.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Parses Kubernetes API server audit logs (JSON lines) to tespit etmeexec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat Tespit rules from audit event patterns. Use investigating yaparken Kubernetes cluster compromise or building k8s-specific SIEM Tespit rules.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

See all skills by MustafaKemal0146

Report a problem with this skill