N0va: Microsoft device code authentication flow completion
Detects successful device code authentication flows involving applications that are not part of a known list of standard Microsoft and Azure client applications. Device code flows are frequently abused in phishing attacks to bypass traditional credential-based authentication.
Microsoft Sentinel (KQL)
