Correlated Device-Code Sign-In to Post-Auth Impact Chain (PRT/Device Reg, Inbox Rule, Reset Survival)
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
Microsoft Sentinel (KQL)
