Entra ID OAuth Device Code Flow with Concurrent Sign-ins
Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2025/12/02"
3integration = ["azure"]
4maturity = "production"
5updated_date = "2026/09/18"
6
7[rule]
8author = ["Elastic"]
9description = """
10Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session.
11This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the
12victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates
13via browser while the requesting application polls for tokens - when these have distinctly different user agents
14(e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.
15"""
16false_positives = [
17 """
18 Legitimate use of device code flow where a user authenticates via browser for a CLI tool or headless application.
19 Common legitimate scenarios include Azure CLI, Azure PowerShell, or VS Code remote development. Review the user
20 agent combinations - browser + known CLI tool from the same user may be expected behavior.
21 """,
22]
23from = "now-9m"
24language = "esql"
25license = "Elastic License v2"
26name = "Entra ID OAuth Device Code Flow with Concurrent Sign-ins"
27note = """## Triage and analysis
28
29### Investigating Entra ID OAuth Device Code Flow with Concurrent Sign-ins
30
31### Possible investigation steps
32
33- Review the sign-in logs to assess the context and reputation of the source.ip address.
34- Investigate the user account associated with the successful sign-in to determine if the activity aligns with expected behavior or if it appears suspicious.
35- Check for any recent changes or anomalies in the user's account settings or permissions that could indicate compromise.
36- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
37- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
38
39### Response and remediation
40
41- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
42- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
43- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
44- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
45- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
46- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
47- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event."""
48references = [
49 "https://learn.microsoft.com/en-us/entra/identity/",
50 "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins",
51 "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema",
52 "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
53 "https://www.wiz.io/blog/recent-oauth-attacks-detection-strategies"
54]
55risk_score = 73
56rule_id = "3db029b3-fbb7-4697-ad07-33cbfd5bd080"
57setup = """#### Required Azure Entra Sign-In Logs
58This rule requires the Azure logs integration be enabled and configured to collect all logs, including sign-in logs from Entra. In Entra, sign-in logs must be enabled and streaming to the Event Hub used for the Azure logs integration.
59"""
60severity = "high"
61tags = [
62 "Domain: Cloud",
63 "Domain: Identity",
64 "Data Source: Azure",
65 "Data Source: Entra ID",
66 "Data Source: Entra ID Sign-In",
67 "Use Case: Identity and Access Audit",
68 "Use Case: Threat Detection",
69 "Tactic: Credential Access",
70 "Resources: Investigation Guide",
71 "Noise: Medium",
72 "Performance: Normal",
73 "Profile: Recommended",
74 "Threat: Device Code Phishing",
75 "Rule Type: ES|QL",
76 "Platform: Entra ID",
77]
78timestamp_override = "event.ingested"
79type = "esql"
80
81query = '''
82from logs-azure.signinlogs-* metadata _id, _version, _index
83
84| where event.category == "authentication" and data_stream.dataset == "azure.signinlogs" and
85 azure.signinlogs.properties.original_transfer_method == "deviceCodeFlow"
86
87// Track events with deviceCode authentication protocol (browser auth) vs polling client
88| eval is_device_code_auth = case(azure.signinlogs.properties.authentication_protocol == "deviceCode", 1, 0)
89
90| stats Esql.count_logon = count(*),
91 Esql.device_code_auth_count = sum(is_device_code_auth),
92 Esql.timestamp_values = values(@timestamp),
93 Esql.source_ip_count_distinct = count_distinct(source.ip),
94 Esql.user_agent_count_distinct = count_distinct(user_agent.original),
95 Esql.user_agent_values = values(user_agent.original),
96 Esql.authentication_protocol_values = values(azure.signinlogs.properties.authentication_protocol),
97 Esql.azure_signinlogs_properties_client_app_values = values(azure.signinlogs.properties.app_display_name),
98 Esql.azure_signinlogs_properties_app_id_values = values(azure.signinlogs.properties.app_id),
99 Esql.azure_signinlogs_properties_resource_display_name_values = values(azure.signinlogs.properties.resource_display_name),
100 Esql.azure_signinlogs_properties_auth_requirement_values = values(azure.signinlogs.properties.authentication_requirement),
101 Esql.azure_signinlogs_properties_tenant_id = values(azure.tenant_id),
102 Esql.azure_signinlogs_properties_status_error_code_values = values(azure.signinlogs.properties.status.error_code),
103 Esql.message_values = values(message),
104 Esql.azure_signinlogs_properties_resource_id_values = values(azure.signinlogs.properties.resource_id),
105 Esql.source_ip_values = values(source.ip)
106 by azure.signinlogs.properties.session_id, azure.signinlogs.identity
107
108// Require: 2+ events, at least one deviceCode auth protocol event, and either 2+ IPs or 2+ user agents
109| where Esql.count_logon >= 2 and Esql.device_code_auth_count >= 1 and (Esql.source_ip_count_distinct >= 2 or Esql.user_agent_count_distinct >= 2)
110| keep
111 Esql.*,
112 azure.signinlogs.properties.session_id,
113 azure.signinlogs.identity
114'''
115
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119
120[[rule.threat.technique]]
121id = "T1528"
122name = "Steal Application Access Token"
123reference = "https://attack.mitre.org/techniques/T1528/"
124
125[rule.threat.tactic]
126id = "TA0006"
127name = "Credential Access"
128reference = "https://attack.mitre.org/tactics/TA0006/"
129
130[[rule.threat]]
131framework = "MITRE ATT&CK"
132
133[[rule.threat.technique]]
134id = "T1078"
135name = "Valid Accounts"
136reference = "https://attack.mitre.org/techniques/T1078/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1078.004"
140name = "Cloud Accounts"
141reference = "https://attack.mitre.org/techniques/T1078/004/"
142
143[[rule.threat.technique]]
144id = "T1566"
145name = "Phishing"
146reference = "https://attack.mitre.org/techniques/T1566/"
147
148[[rule.threat.technique.subtechnique]]
149id = "T1566.002"
150name = "Spearphishing Link"
151reference = "https://attack.mitre.org/techniques/T1566/002/"
152
153[rule.threat.tactic]
154id = "TA0001"
155name = "Initial Access"
156reference = "https://attack.mitre.org/tactics/TA0001/"
Triage and analysis
Investigating Entra ID OAuth Device Code Flow with Concurrent Sign-ins
Possible investigation steps
- Review the sign-in logs to assess the context and reputation of the source.ip address.
- Investigate the user account associated with the successful sign-in to determine if the activity aligns with expected behavior or if it appears suspicious.
- Check for any recent changes or anomalies in the user's account settings or permissions that could indicate compromise.
- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
Response and remediation
- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.
References
-
Microsoft Entra ID is Microsoft's multitenant, cloud-based directory, and identity management service that combines core directory services, application access management, and identity protection into a single solution.
Read More -
Learn about the different types of sign-in logs that are available in Microsoft Entra monitoring and health.
Read More -
Learn how to interpret the details found in the Microsoft Entra audit and sign-in and logs schema.
Read More -
Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals. This activity comes on the heels of attacks Volexity reported on back in February 2025, where Russian threat actors were discovered targeting users and organizations through Device Code Authentication phishing...
Read More -
Attackers abuse OAuth flows like device code phishing and ROPC to bypass MFA and gain persistence in Azure. Here's how to detect them with Entra ID logs.
Read More
Related rules
- Entra ID User Sign-in Brute Force Attempted
- Entra ID Concurrent Sign-in with Suspicious Properties
- Entra ID MFA TOTP Brute Force Attempted
- Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
- Microsoft Entra ID Impossible Travel Sign-in