Device-Code Sign-in Followed by Bulk Mailbox Access and Outbound Send
Detects a sequence of events starting with a user signing in via the OAuth device code flow, followed immediately by mailbox item enumeration and sending of email. This pattern is characteristic of attackers who use device code phishing to steal tokens, subsequently using those tokens to access mailboxes and send malicious emails from the compromised account.
Sigma
