OAuth Device Code Authentication Flow Sign-In Detection
This rule detects successful or attempted sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. This specific authentication flow is increasingly leveraged by adversaries in passkey-themed phishing campaigns to obtain valid access and refresh tokens without requiring direct credential or cookie theft. By monitoring for this protocol usage, security teams can identify potential attempts to bypass traditional authentication mechanisms.
Microsoft Sentinel (KQL)
