ARToken Device Code Flow Sign-in Bypassing Interactive MFA

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•3

This rule detects successful user logins utilizing the OAuth 2.0 device authorization grant flow where Multi-Factor Authentication (MFA) was bypassed, not applied, or not performed. The device code flow is a common vector for phishing attacks where users are tricked into entering a device code on a malicious site, potentially leading to unauthorized token acquisition.