Device-Code Auth to Persistence/Inbox Rule Chain with PRT-Survives-Reset Escalation

Renata Cardoso@rcardososec

•updated Jul 3, 2026•5•1•15

This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.