AiTM/Device-Code Auth Flow Compromise via Session Token Reuse

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•2

This rule identifies potentially malicious Azure AD/Entra authentication flows by flagging interruptions during MFA (e.g., failure codes 50074, 50140 indicating MFA requirements or time-outs during suspected AiTM phishing attempts) and the usage of Device Code Grant flows, which are frequently abused by adversaries to bypass MFA and capture session tokens.