ARToken M365 Sign-in via Residential Proxy with Device Code Auth

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

This rule detects successful user logins that utilize the 'deviceCode' authentication protocol in conjunction with suspicious network indicators, specifically traffic originating from residential proxies. This combination is highly indicative of potential phishing or unauthorized access attempts using stolen session tokens or bypassed MFA mechanisms.