[IA] - Detects Device Code authentication flow using distinct Browsers,Countries,IPs or UserAgents
attackers are continuously abusing Device Code phishing, convincing victims to authenticate using the legitimate Microsoft login page. The victim completes the password and MFA correctly, but the resulting tokens are delivered to the attacker. And one point that I think is important: Device Code Flow should not be enabled if you don't really need it. The recommendation is clear: disable it where possible and only allow documented exceptions. The KQL below takes Cmsi:Cmsi as a reference (which means a Device Code Authentication flow was used) point and looks 15 minutes backwards (the time that a Code is valid) for the same user, grouping the authentication flow together with countries, IPs, browsers and User-Agents. The aim is to identify authentication flows where we observe different Browsers, Countries, IPs or User-Agents, potentially showing the transition between the victim and attacker context. The idea is simple: Look at the complete authentication sequence and identify what changes between the victim and attacker context.
Microsoft Sentinel (KQL)
