Skip to content

Instantly share code, notes, and snippets.

@ciphertxt

ciphertxt/GetGrantedOATHPerms.ps1

Last active July 14, 2020 12:45
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ciphertxt/760869efbabc316a6f3596e10f5fa122 to your computer and use it in GitHub Desktop.
Save ciphertxt/760869efbabc316a6f3596e10f5fa122 to your computer and use it in GitHub Desktop.
Download ZIP
Spot check Granted OATH permissions. Attackers are utilizing malicious OATH grants for persistence.
Raw
GetGrantedOATHPerms.ps1
Get-AzureADServicePrincipal `
-Filter "serviceprincipaltype eq 'Application'" -All $true -PipelineVariable sp `
| Get-AzureADServicePrincipalOAuth2PermissionGrant `
-top 1 `
| select @{N="SPDisplayname";E={$sp.displayname}}, @{N="SPObjectid";E={$sp.objectid}}, consenttype, scope
#https://twitter.com/rootsecdev/status/1282640558025060354
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment