EvilTokens Backend API Interaction
Identifies network traffic targeting the backend API endpoints associated with EvilTokens device code generation and token weaponization. This rule specifically looks for requests to paths like /api/device/start, /api/device/status, /api/device/sessions, and various /api/prt/ endpoints (convert, refresh, exchange, cookie, owa-session, recon, azure) which are indicative of EvilTokens activity.
Microsoft Sentinel (KQL)
