Google device-code OAuth flow abused for phishing (Kali365)
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Microsoft Sentinel (KQL)
