N0va: Device registration shortly after device-code token exchange

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•1

This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).