Microsoft Device Code Phishing

An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.

This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.

Sublime rule (View on GitHub)

 1name: "Microsoft Device Code Phishing"
 2description: |
 3  An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
 4
 5  This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.  
 6type: "rule"
 7authors:
 8  - twitter: "ajpc500"
 9references:
10  - "https://aadinternals.com/post/phishing/"
11  - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
12  - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
13  - "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/"
14severity: "medium"
15source: |
16  type.inbound
17
18  // Not from MS as the device code will be generated and sent by the attacker
19  and sender.email.domain.root_domain not in~ ("microsoft.com", "microsoftonline.com")
20
21  // Link to the device code MS pages
22  and any(body.links,
23          (
24            .href_url.url == "https://microsoft.com/devicelogin"
25            or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
26            or .href_url.url == "https://aka.ms/devicelogin"
27          )
28  )
29
30  // Body text references device codes
31  and (
32    strings.icontains(body.html.display_text, "device code")
33    or 
34    // A nine character string containing a combination of letters and characters
35    regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
36  )
37  and (
38    not profile.by_sender().solicited
39    or (
40      profile.by_sender().any_messages_malicious_or_spam
41      and not profile.by_sender().any_false_positives
42    )
43  )  
44attack_types:
45  - "Credential Phishing"
46tactics_and_techniques:
47  - "Impersonation: Brand"
48  - "Social engineering"
49detection_methods:
50  - "Content analysis"
51  - "Sender analysis"
52  - "URL analysis"
53id: "61f3ae67-c05c-506f-bbfe-764108a40974"
to-top