ARToken Graph API Proxy Abuse via Captured Device-Code OAuth Tokens

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•1

Detects anomalous access to sensitive Microsoft Graph API endpoints (messages, mailFolders, contacts) following a device-code authentication. The rule specifically flags activity from non-standard or generic client applications, which is a pattern often associated with post-compromise proxying or token abuse, such as the 'ARToken' technique.