Device code sign-in via Microsoft Authentication Broker (Forg365 phishing)
Detects successful device-code authentication flow completions using the Microsoft Authentication Broker client, which is frequently targeted or abused in phishing attacks bypassing traditional MFA.
Microsoft Sentinel (KQL)
