App Granted Microsoft Permissions (c1d147ae-a951-48e5-8b41-dcd0170c7213)
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| App Granted Microsoft Permissions (c1d147ae-a951-48e5-8b41-dcd0170c7213) | Sigma-Rules | Steal Application Access Token - T1528 (890c9858-598c-401d-a4d5-c67ebcdd703a) | Attack Pattern | 1 |