Microsoft Device Code Flow Authentication
Detects successful or anomalous authentications utilizing the Microsoft device code flow. Kali365 and other phishing-as-a-service platforms actively abuse this flow to register attacker devices, bypassing multi-factor authentication (MFA) and gaining unauthorized access to Microsoft 365 environments.
Sigma
