HuskyHacks/cazadora: Simple hunting script for suspicious M365 OAuth Apps

Source: GitHub Author: unknown URL: https://github.com/HuskyHacks/cazadora

  1. ONE SENTENCE SUMMARY: A quick triage script for detecting suspicious Microsoft 365 OAuth apps using Graph API authentication and predefined hunting rules.

  2. MAIN POINTS:

  3. Uses device code or Azure SDK authentication to retrieve a Graph API token.

  4. Enumerates a tenant’s applications and service principals via the Graph API.

  5. Runs hunting rules against collected data to identify suspicious apps.

  6. Outputs results with color coding based on confidence levels.

  7. Requires user authentication with Graph API query permissions.

  8. Supports running in a Docker container for dependency management.

  9. Flags suspicious apps based on naming conventions and reply URLs.

  10. Highlights risks of default user consent settings in Microsoft 365.

  11. Recommends configuring user consent settings to prevent unauthorized app installations.

  12. Does not guarantee complete detection of suspicious applications.

  13. TAKEAWAYS:

  14. The script helps identify potentially malicious OAuth apps in a Microsoft 365 tenant.

  15. Authentication is required via device code or Azure SDK web login.

  16. Suspicious apps are flagged based on predefined threat intelligence rules.

  17. Users should configure consent settings to limit unauthorized app installations.

  18. The script is a helpful tool but not a definitive security solution.