BSidesLuxembourg
Jerrad DahlagerMicrosoft warned about OAuth redirect abuse on March 2, 2026. This isn't credential theft or classic token theft by itself. It weaponizes Entra ID error handling.
An attacker registers an OAuth app with a malicious redirect URI, sends a crafted login.microsoftonline.com link designed to fail, and Entra ID's 302 redirect lands the victim on a phishing page or malware dropper. The sign-in fails and the attacker still wins.
I built a detection and hardening kit you can deploy to an existing Sentinel workspace:
• 4 analytics rules: consent after risky sign-in, suspicious redirect URIs, OAuth error clustering, bulk consent
• 5 hunting queries: permissions baseline, non-corporate IP auth, high-privilege apps, URI inventory, token replay
• 1 workbook: OAuth Security Dashboard
Entra hardening: verified-publisher consent restriction, MFA policy for risky OAuth sign-ins
• OAuth app audit: flags suspicious redirect URIs and overprivileged permissions across app registrations
Blog post: https://nineliveszerotrust.com/blog/oauth-redirect-abuse-sentinel/
Companion lab on GitHub: https://github.com/j-dahl7/oauth-redirect-abuse-sentinel
#MicrosoftSentinel #EntraID #DetectionEngineering #OAuth #IdentitySecurity #BlueTeam
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
Microsoft warned about OAuth redirect abuse enabling phishing and malware delivery. Build Sentinel analytics rules, hunting queries, a security workbook, and Entra ID hardening policies to detect and prevent this technique in your tenant.
TechNadu
0xFustang
