OAuth Application Required Resource Access Update

id: 665e6075-3a3f-42c0-a6c7-7e83dc44f281
name: OAuth Application Required Resource Access Update
description: |
  'This hunting query identifies updates to the RequiredResourceAccess property of an OAuth application.
  This property specifies resources that an application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources.
  This pre-configuration of required resource access drives the consent experience. The resourceAccess property of the requiredResourceAccess type is a collection of ResourceAccess.
  A threat actor might update this property before granting permissions to an application.
  '
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
tactics:
  - Persistence
relevantTechniques:
  - T1098
tags:
  - SimuLand
query: |
  AuditLogs
  | where Category =~ "ApplicationManagement"
  | where ActivityDisplayName has_any ("Update application")
  | where Result =~ "success"
  | where tostring(InitiatedBy.user.userPrincipalName) has "@" or tostring(InitiatedBy.app.displayName) has "@"
  | extend UserAgent = tostring(AdditionalDetails[0].value)
  | extend InitiatingUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
  | extend InitiatingIpAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
  | extend ModifiedApplication = tostring(TargetResources[0].displayName)
  | extend ModifiedApplicationObjectId = tostring(TargetResources[0].id)
  | extend ModifiedProperties = parse_json(tostring(TargetResources[0].modifiedProperties))
  | extend ModifiedPropertyName = tostring(ModifiedProperties[0].displayName)
  | extend ResourceAppId = parse_json(tostring(ModifiedProperties[0].newValue))[0].ResourceAppId
  | where ModifiedPropertyName =~ "RequiredResourceAccess"
  | extend Type = tostring(TargetResources[0].type)
  | project-away ModifiedProperties
  | project-reorder TimeGenerated, OperationName, InitiatingUser, InitiatingIpAddress, UserAgent, ModifiedApplication, ModifiedApplicationObjectId, CorrelationId, TenantId
  | extend timestamp = TimeGenerated, AccountCustomEntity = InitiatingUser, IPCustomEntity = InitiatingIpAddress
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.0