Full Report
Malicious OAuth apps can hide inside Microsoft 365 tenants. Huntress Labs' Cazadora script helps uncover rogue apps before they lead to a breach. Dive deeper in their Tradecraft Tuesday sessions. [...]
Analysis Summary
# Tool/Technique: Cazadora
## Overview
Cazadora is an open-source script developed by Huntress Labs to help administrators audit and find potentially hidden, malicious OAuth applications within Microsoft 365 tenants, specifically targeting configurations that often evade standard security measures.
## Technical Details
- Type: Tool
- Platform: Microsoft 365 / Azure environment management
- Capabilities: Auditing Enterprise Applications and Application Registrations for suspicious naming conventions and anomalous reply URLs associated with malicious OAuth apps.
- First Seen: October 20, 2025 (Date of article publication)
## MITRE ATT&CK Mapping
This tool directly aids in *discovery* related to compromised accounts and applications often utilized for persistent access or privilege escalation.
- **TA0006 - Credential Access** (Indirectly, by locating the means for token theft/impersonation)
- T1552 - Unsecured Credentials
- **TA0007 - Discovery**
- T1518 - Software Discovery (Focused on discovering rogue applications)
- **TA0003 - Persistence** (Rogue OAuth apps are a primary persistence mechanism)
- T1556 - Compromise Client Software Credential (Related to initial compromise enabling setup)
## Functionality
### Core Capabilities
The script focuses on identifying suspicious characteristics in registered OAuth applications:
- Apps named after a user account.
- Apps named "Test," "Test App," or similar generic identifiers.
- Apps named after the tenant domain name where they are installed.
- Apps using arbitrary non-alphanumeric strings as names (e.g., "........").
### Advanced Features
- Detection of **Anomalous reply URLs**, specifically flagging the presence of a local loopback URL targeting port 7823 (`http://localhost:7823/access/`). This URL pattern is often associated with client-side token interception or Man-in-the-Middle setups.
## Indicators of Compromise (Associated with Suspicious Apps Found by Cazadora)
- File Hashes: [N/A - Tool focuses on configuration/metadata]
- File Names: [N/A]
- Registry Keys: [N/A]
- Network Indicators: Anomalous reply URL pointing to `http://localhost:7823/access/` (Defanged: `http://localhost:7823/access/`)
- Behavioral Indicators: Presence of OAuth applications registered with highly suspicious or covert naming conventions and reply URIs that suggest local callback mechanisms.
## Associated Threat Actors
[The article focuses on the technique utilized by threat actors rather than naming specific actors who use this method, implying it is a common technique seen by Huntress.]
## Detection Methods
- **Signature-based detection**: N/A (Configuration-based audit)
- **Behavioral detection**: Analyzing Azure/Microsoft 365 audit logs for the creation and interaction with OAuth apps matching the identified suspicious patterns.
- **YARA rules**: [N/A]
## Mitigation Strategies
- **Prevention measures**: Implement strict governance policies on who can register applications in Azure AD/Microsoft 365.
- **Hardening recommendations**: Regularly audit the Enterprise Applications and Application Registrations sections for any apps exhibiting suspicious names or configurations, particularly those using internal proxy or loopback addresses in reply URLs for external access.
## Related Tools/Techniques
- Adversary in the Middle (AitM) attacks (mentioned contextually as a related threat to initial access).
- Huntress's "Unwanted Access" capability.
- Techniques related to token theft and session hijacking within identity platforms.