T1528: Microsoft Authentication Broker Device-Code Failure (50199) Then Success From Same IP

Tim Peck@timpeck

•updated Jul 8, 2026•15•0•28

Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.