OAuth Token Issuance via Device Code Authentication Flow
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Cortex XDR
