Microsoft 365 Device Code Phishing Authentication (Greatness / AiTM)
Detects successful sign-ins using the device code authentication flow that are infrequent for a specific user and location. This flow is often targeted by attackers attempting to bypass MFA or perform device phishing, as it requires the user to manually authorize the device on a separate platform.
Microsoft Sentinel (KQL)
