Device code auth phishing followed by new OAuth consent (CSuite)
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
Microsoft Sentinel (KQL)
