Azure AD Device Code Phishing from Unmanaged/Non-Compliant Devices
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged and non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
Cortex XDR
