Entra Privilege Escalation Following Device-Code Sign-In
Detects administrative role assignments or additions, such as 'Global Administrator', occurring for a user shortly after a device code authentication event. This pattern is indicative of ARToken-based post-compromise activity where an adversary uses an illicitly obtained device code to escalate privileges within a cloud environment.
YARA-L
