6 Months of Researching OAuth Application Attacks | Huntress

This Huntress report describes how attackers abuse Azure/Microsoft 365 OAuth applications—both legitimate apps misused by adversaries (Traitorware) and custom malicious app registrations (Stealthware)—to gain persistent tenant access. The authors enumerated thousands of tenants, found ~10% prevalence of certain abused apps and hundreds of bespoke malicious apps, outline detection/hunting heuristics (rare apps, unusual names, suspicious reply URLs such as http://localhost:7823/access/), and released an open-source audit tool (Cazadora) to help admins find and remediate malicious service principals.