GhostCode: Rapid Multi-Device Registration After Device Code Token Theft

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

This rule detects anomalous behavior where a single user account registers multiple devices within a very short timeframe (80 seconds). This pattern often follows the theft of a device code or OAuth authorization token, where an adversary attempts to rapidly enroll multiple rogue devices to maintain persistent access or bypass MFA controls.