Elastic high stable kql

Entra ID OAuth Device Code Phishing via AiTM

Detects successful Microsoft Entra ID sign-ins that use the OAuth device code authentication protocol with the Microsoft Authentication Broker client requesting first-party Office API resources (Exchange Online, Microsoft Graph, or SharePoint) while flagged as interactive. This pattern is associated with adversary-in-the-middle (AiTM) phishing kits such as Tycoon 2FA, where victims complete device code flows that ultimately broker tokens for mail and collaboration APIs.

View Source

Detection Logic

data_stream.dataset:"azure.signinlogs" and event.category:"authentication" and event.action:"Sign-in activity" and
event.outcome:success and azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
azure.signinlogs.properties.authentication_protocol:deviceCode and
azure.signinlogs.properties.resource_id:(
    "00000002-0000-0ff1-ce00-000000000000" or
    "00000003-0000-0ff1-ce00-000000000000" or
    "00000003-0000-0000-c000-000000000000"
) and azure.signinlogs.properties.is_interactive:true

False Positives

⚠ Rare legitimate interactive device code flows that use the Microsoft Authentication Broker against Exchange, Graph, or Yammer may match, for example during troubleshooting or specialized kiosk setups. Document approved scenarios and exclude known principals or networks.

Field Validations

Loading…

Comments (0)

Loading comments...