🔐 Honey OAuth Application

Fake OAuth apps detecting consent phishing.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Register fake OAuth applications in Entra ID / Google Workspace with attractive scopes (e.g., Mail.Read, Files.ReadWrite.All). If an attacker grants consent to this application during a consent phishing attack, the application logs the grant and alerts.

Implementation requirements

Entra ID / Google Workspace admin access to register applications
OAuth app with monitoring webhook on consent events
Attractive but non-functional scopes
Azure AD audit logs / Google Workspace Admin SDK monitoring
Rollback: Delete the app registration and revoke any consent granted to it.
Upkeep: Renew its secret or certificate before expiry. Quarterly check that its consent alert still fires.

Technologies

AzureGoogle Workspace

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1528 Steal Application Access Token	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1528 Steal Application Access Token as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1528 to its Lures activity. A stolen honey token fires when it is used, not when it is stolen.
T1550.001 Application Access Token	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550.001 Application Access Token as an adversary behaviour.

Evidence

Implementer's Guide to Deception Technologies — SANS Institute 2020 industry
Microsoft Entra security operations for applications — Microsoft industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Implementer's Guide to Deception Technologies" — SANS Institute, 2020.