Microsoft device code phishing

 1name: "Microsoft device code phishing"
 2description: |
 3  An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
 4
 5  This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.  
 6type: "rule"
 7authors:
 8  - twitter: "ajpc500"
 9references:
10  - "https://aadinternals.com/post/phishing/"
11  - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
12  - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
13  - "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/"
14severity: "medium"
15source: |
16  type.inbound
17  
18  // Not from MS as the device code will be generated and sent by the attacker
19  and sender.email.domain.root_domain not in~ (
20    "microsoft.com",
21    "microsoftonline.com"
22  )
23  
24  // Link to the device code MS pages
25  and any(body.links,
26          (
27            .href_url.url == "https://microsoft.com/devicelogin"
28            or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
29            or .href_url.url == "https://aka.ms/devicelogin"
30          )
31  )
32  
33  // Body text references device codes
34  and (
35    strings.icontains(body.html.display_text, "device code")
36    or 
37    // A nine character string containing a combination of letters and characters
38    regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
39  )
40  and (
41    not profile.by_sender().solicited
42    or (
43      profile.by_sender().any_messages_malicious_or_spam
44      and not profile.by_sender().any_messages_benign
45    )
46  )  
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Impersonation: Brand"
51  - "Social engineering"
52detection_methods:
53  - "Content analysis"
54  - "Sender analysis"
55  - "URL analysis"
56id: "61f3ae67-c05c-506f-bbfe-764108a40974"