# Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoring

arXiv: https://arxiv.org/abs/2512.15781 · HTML: https://mlsanity.com/paper/2512.15781/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Dec 2025.

## Built on by (most cited first, 1 of 1)

- [Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures](https://mlsanity.com/paper/2605.25435/) (2026)

## Abstract (arXiv)

This project presents a unified detection framework that constructs a complete corpus of Microsoft Graph permissions, generates consistent LLM-based risk scores, and integrates them into a real-time detection engine to identify malicious OAuth consent activity.