[IA] - Hunting Web Activity Before a Device Code Authentication
Weekly, I have to analyze different Device Code Phishing cases. We already have very good reports, TI feeds and IOC lists with URLs and domains used in these attacks, but there is always a problem: someone needs to find and report the IOC first. What if the phishing domain was registered today? What if nobody has reported it yet and your user is one of the first targets? So instead of waiting for the IOC, I wanted to look at the behaviour. We know that a Device Code authentication happened, so why not look at what the user was doing just before it? The KQL takes the Cmsi:Cmsi event as the reference and goes 5 minutes backwards, collecting the last 3 websites visited by the same user before the Device Code authentication, together with their countries. 🌐 URL → 🌐 URL → 🌐 URL → 🔐 Device Code From there we can remove Microsoft services, known sites and expected countries and focus on what looks different. A domain with zero reputation and no presence in any. If an user visited an unknown site just before a Device Code authentication, from an unexpected location, I definitely want to have a look. This is not about detecting Device Code. It is about getting more context around it and, again, trying to focus a little more on IOAs and behaviour instead of only IOCs. That sequence is what I want to hunt in this new KQL Query.
Microsoft Sentinel (KQL)
