Azure AD OfficeHome Authentication Error 90014 (Potential AiTM Phishing)

Lacey Cochrane@NullVectorX

•updated Aug 9, 2026•57•0•22

This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.