Microsoft Device Code Phishing
An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.
Sublime rule (View on GitHub)
1name: "Microsoft Device Code Phishing"
2description: |
3 An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
4
5 This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.
6type: "rule"
7authors:
8 - twitter: "ajpc500"
9references:
10 - "https://aadinternals.com/post/phishing/"
11 - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
12 - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
13 - "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/"
14severity: "medium"
15source: |
16 type.inbound
17
18 // Not from MS as the device code will be generated and sent by the attacker
19 and sender.email.domain.root_domain not in~ ("microsoft.com", "microsoftonline.com")
20
21 // Link to the device code MS pages
22 and any(body.links,
23 (
24 .href_url.url == "https://microsoft.com/devicelogin"
25 or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
26 or .href_url.url == "https://aka.ms/devicelogin"
27 )
28 )
29
30 // Body text references device codes
31 and (
32 strings.icontains(body.html.display_text, "device code")
33 or
34 // A nine character string containing a combination of letters and characters
35 regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
36 )
37 and (
38 not profile.by_sender().solicited
39 or (
40 profile.by_sender().any_messages_malicious_or_spam
41 and not profile.by_sender().any_false_positives
42 )
43 )
44attack_types:
45 - "Credential Phishing"
46tactics_and_techniques:
47 - "Impersonation: Brand"
48 - "Social engineering"
49detection_methods:
50 - "Content analysis"
51 - "Sender analysis"
52 - "URL analysis"
53id: "61f3ae67-c05c-506f-bbfe-764108a40974"