skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-oauth

Detect OAuth abuse and consent-related security incidents in Entra ID environments.

1|Updated Apr 27, 2026
Search Tags:#oauth#detection#incident-response#kql#sigma#consent-phishing#ai-tm-proxy
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-oauth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-oauth
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-oauth
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-oauth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect OAuth abuse in identity ecosystems, including consent phishing, AiTM proxy session hijacking, redirect URI manipulation, and CSRF-related risks, to protect users and data.

Core Features & Use Cases

  • Consent phishing detection identify suspicious consent grants and risky app permissions in Entra ID.
  • AiTM/session hijack detection correlate MFA and session IPs to catch anomalous logins.
  • Redirect URI abuse monitor for OAuth redirects to untrusted domains and misconfigurations.
  • Threat remediation guidance provide actionable response steps and hardening recommendations for SOC.

Quick Start

Activate this skill to start detecting OAuth threats in your identity environment and triage alerts effectively.

Frequently Asked Questions about defensive-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect OAuth consent phishing in Entra ID?▼

Detect OAuth consent phishing in Entra ID by analyzing AuditLogs and CloudAppEvents for suspicious app permissions and risky consent grants. This identifies malicious applications that trick users into granting excessive data access.

What is OAuth redirect URI abuse and how do I monitor for it?▼

OAuth redirect URI abuse involves manipulating redirects to untrusted domains or misconfigurations. Monitor OAuth redirects across OfficeActivity and SigninLogs to identify sessions routed to malicious infrastructure.

Can I use Sigma rules to triage OAuth threats in my identity environment?▼

You can use Sigma rules to triage OAuth threats by applying detection logic across Entra ID logs. This standardizes threat detection for consent phishing and AiTM proxy incidents.

What is the best way to respond to OAuth consent phishing incidents?▼

The best way to respond to OAuth consent phishing incidents is to follow actionable threat remediation guidance. This includes revoking malicious app consent and implementing identity hardening recommendations for your SOC.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

entra-id

Map Microsoft Entra ID telemetry logs to detection patterns.

Official
Advanced
YukiIto1999YukiIto1999

detecting-suspicious-oauth-application-consent

Enumerate OAuth2 permission grants in Azure AD via Microsoft Graph API and flag suspicious consent activity.

Community
Advanced
riparinoriparino
1

defensive-sqli

Correlate web, WAF, and database logs to detect SQL injection attempts.

Community
Intermediate
riparinoriparino
1

defensive-jwt

Detect unsigned JWT tokens, header injections, and algorithm confusion.

Community
Advanced