GhostCode: Intune enrollment persisting after token revocation

Ibrahim Saud@tektrix

•updated Sep 17, 2026•3•0•3

Detects successful Microsoft Intune enrollment events initiated using the Device Code authentication protocol in Azure AD/Entra ID. This flow is often abused by adversaries to perform OAuth device code phishing, allowing them to gain unauthorized access to cloud resources by tricking users into authorizing a malicious application on their own devices.