OAuth Apps accessing user mail via GraphAPI [Nobelium]

id: 19cbed50-3554-44ed-b8de-90f275b69c8a
name: OAuth Apps accessing user mail via GraphAPI [Nobelium]
description: |
  This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Exfiltration
tags:
- Nobelium
query: |
  CloudAppEvents 
  | where Timestamp >= ago(1h) 
  | where ActionType == "MailItemsAccessed" 
  | where RawEventData has "00000003-0000-0000-c000-000000000000" // performance 
  | where RawEventData has "ClientAppId" 
  | extend rawData = parse_json(RawEventData) 
  | extend AppId = tostring(parse_json(rawData.AppId)) 
  | where AppId == "00000003-0000-0000-c000-000000000000"         // graph API 
  | extend OAuthAppId = tostring(parse_json(rawData.ClientAppId)) // extract OAuthAppId 
  | summarize by OAuthAppId