A confidence the scenario's author stated when writing it — not a measured rate. Nothing here has yet been scored against a human's later verdict; calibration arrives when outcomes exist (R96), and until then no figure is invented for it.
Risk shown is the action’s base score. Effective risk rises with blast radius, production environment, and low confidence — it never falls, and the dashboard never computes it here.
Timeline
agent:sentinelcorrelateddelivery, click, consent and bulk read on one account within 31 minutes
agent:analystdiagnosedno password authentication in the window — this is a token, not a credential
asset:m.okafor-mailbox — message from a lookalike domain deliveredchain-0, SEC-0002-a
asset:oauth-app-Rep0rt-Sync — OAuth consent granted to an unfamiliar application
The plausible and wrong explanation
○ruled out
The case for it
The account's password was compromised and used to sign in.
It explains SEC-0002-d — the same observation the diagnosis rests on.
What rules it out
SEC-0002-e, SEC-0002-c. The diagnosis stands: A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox.
Acting on asset:m.okafor-mailbox at 23:49Z — the first moment the records would have justified it — would have pre-empted 1 recorded step over the following 30 minutes.
What would not have happened
00:19Zasset:m.okafor-mailboxmailbox read in bulk by the issued tokenSEC-0002-d
What would have happened anyway
Later than the intervention, but not downstream of it.
23:56Zasset:oauth-app-Rep0rt-SyncOAuth consent granted to an unfamiliar applicationSEC-0002-b, SEC-0002-c
What this estimate rests on
Timed from 4 stored event(s); each step is dated to the earliest record that established it.
Downstream reach of asset:m.okafor-mailbox taken from 0 stored access edge target(s), each citing its own evidence. A later step not among them is reported as unavoidable rather than counted.
Draft: Steal Application Access Token observed in INC-2026-0902
○parses as sigma◆indicator match
Drafted for T1528 Steal Application Access Token (Credential Access), from the events this incident’s causal step cites.
Adjustments only ever raise risk. An action cannot argue its way into a lower tier.
What success will look like
sessioninvalid
Declared before execution. Verification compares observed state to this, and a check with no observation counts as a failure — “don’t know” is never recorded as success.
requires: operatorverdict expires — a stale approval cannot be replayed against changed state
Nothing was executed. The plan was drawn up and did not run.INC-2026-0902
What was verified
No verification is recorded, so nothing here says the incident was resolved rather than merely closed.INC-2026-0902
Adopting this is adopt_report — scored 44, approval required by operator.
Nothing here has been adopted. This document is assembled from the incident each time it is asked for, so it cannot go stale against the incident it describes — and it cannot be saved into something that stops saying draft.
Adopting this is adopt_playbook — scored 44, approval required by operator.
Nothing here has been adopted. This document is assembled from the incident each time it is asked for, so it cannot go stale against the incident it describes — and it cannot be saved into something that stops saying draft.
Confidence is shown and does not decide the verdict. The alternative is beaten only where something stored contradicts it.
Assumes the action would have been immediate and complete. Nothing stored measures how long it takes to apply or whether it fully works.
Assumes the attacker would not have taken another route. The records describe what happened once; they cannot say what would have been tried next, and a determined intruder blocked at one path is not a stopped one.
Derived from this incident’s stored timeline and the access edges between its entities, both of which cite their own evidence. It is an estimate, not a measurement: nothing recorded here says what the intruder would have done next.
(none)payload.detection_type on SEC-0002-b is 'phishing_link_followed', which is this platform's own detector label rather than a field of the source log. Sigma matches what the log recorded, not what we concluded from it, so there is no field for this and inventing one would encode our verdict as somebody else's observation
(prose)labels.summary on SEC-0002-b names the detail a stronger rule would key on, in prose written for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is the guessing this module refuses everywhere else
SubjectUserNamepayload.principal on SEC-0002-c is 'oauth-app-Rep0rt-Sync', which is a asset and not an account. Mapping it to a user field would put a hostname in a username: the rule would parse, cite a real stored value, and match nothing
(none)payload.detection_type on SEC-0002-c is 'oauth_consent_granted', which is this platform's own detector label rather than a field of the source log. Sigma matches what the log recorded, not what we concluded from it, so there is no field for this and inventing one would encode our verdict as somebody else's observation
(prose)labels.summary on SEC-0002-c names the detail a stronger rule would key on, in prose written for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is the guessing this module refuses everywhere else
The rule
# DRAFT - assembled from one incident's stored telemetry. Not deployed,
# not validated against a live log pipeline, and not adopted.
# Incident: INC-2026-0902
# Technique: T1528 Steal Application Access Token (Credential Access)
#
# Every field below was read from a stored event:
# TargetUserName <- entity_ref.id (matches this incident only); SEC-0002-b
# SubjectUserName <- payload.principal (matches this incident only); SEC-0002-b
#
# WARNING: every field is an instance value. This matches this incident and not the technique.
title: 'Draft: Steal Application Access Token observed in INC-2026-0902'
id: 33f458a6-6181-5ed4-ac3e-416497966a37
status: experimental
description: 'Drafted from INC-2026-0902, which recorded: OAuth consent granted to an unfamiliar application.
Fields below were read from SEC-0002-b, SEC-0002-c.'
references:
- INC-2026-0902
- SEC-0002-b
- SEC-0002-c
author: Sati (drafted from one incident; not validated against live telemetry)
date: 2026/10/18
tags:
- attack.credential_access
- attack.t1528
logsource:
category: security
product: pashupatastra
service: demo
detection:
selection:
TargetUserName: m.okafor
SubjectUserName: m.okafor
condition: selection
falsepositives:
- Every field is specific to INC-2026-0902 (TargetUserName=m.okafor, SubjectUserName=m.okafor). This will
match unrelated activity on the same entities and nothing elsewhere.
level: medium
x-provenance:
TargetUserName:
source_field: entity_ref.id
observed_in:
- SEC-0002-b
generalises: false
SubjectUserName:
source_field: payload.principal
observed_in:
- SEC-0002-b
generalises: false
x-not-mapped:
(none): payload.detection_type on SEC-0002-c is 'oauth_consent_granted', which is this platform's own
detector label rather than a field of the source log. Sigma matches what the log recorded, not what
we concluded from it, so there is no field for this and inventing one would encode our verdict as
somebody else's observation
(prose): labels.summary on SEC-0002-c names the detail a stronger rule would key on, in prose written
for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is
the guessing this module refuses everywhere else
SubjectUserName: 'payload.principal on SEC-0002-c is ''oauth-app-Rep0rt-Sync'', which is a asset and
not an account. Mapping it to a user field would put a hostname in a username: the rule would parse,
cite a real stored value, and match nothing'
x-warning: Every field in this rule is an instance value from this incident. It would have matched this
occurrence and will not match another; it is an indicator match, not a behavioural detection.
Drafted from stored telemetry, never deployed and never adopted. Every field above was read from an event this incident cites; nothing was written from what a model knows about Sigma. Every rule the console holds, drafted and written →
○observeddrishti
no password authentication event for m.okafor in the window
○observeddrishti
mailbox read in bulk using the new token
○reasonedbuddhi
The account's password was compromised and used to sign in. (4%) · ruled out by SEC-0002-e, SEC-0002-c
○reasonedbuddhi
A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox. (91%)
○observeddrishti
token issued to 'Rep0rt Sync', an application never consented to before
○observeddrishti
proxy log records the link being followed
○observeddrishti
message from rn1crosoft-billing.com delivered to m.okafor
ruled out: The account's password was compromised and used to sign in.
