Device Code Phishing: Unusual Device Code Flow Detected
This alert finds sessions where a device-code flow produced multiple sign-in events (interactive + non-interactive), with mismatched user-agents or differing country/geolocation, for the same Session ID - a strong indicator of device-code phishing abuse. Looks for: Brute-forcing device code tokens Token replay attempts Malicious use of device code authentication across different devices or locations Anomalous sign-in behaviour suggesting account compromise
Microsoft Sentinel (KQL)
