DEBULL Device-Code Phishing URL Chain via Proxy/Network Telemetry

Duo Tech@duotech

•updated Jul 9, 2026•3•0•24

This rule monitors network traffic for DNS queries and HTTP requests directed toward known malicious domains associated with phishing campaigns, specifically those leveraging OAuth device code authorization flows (e.g., /devicelogin, /deviceauth) and credential harvesting sites.