Kali365 - Device Code Phishing Lure Delivery (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•11

Detects inbound email patterns characteristic of the Kali365 campaigns, containing instructions and formatting that prompt users to enter a specific device code. The rule identifies emails with specific subject line keywords and URLs pointing to microsoft.com/devicelogin.