Identity compromise via device-code OAuth authentication flow abuse
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
YARA-L
