Microsoft Device Code Phishing

 1name: "Microsoft Device Code Phishing"
 2description: |
 3  An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
 4
 5  This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.  
 6type: "rule"
 7authors:
 8  - twitter: "ajpc500"
 9references:
10  - "https://aadinternals.com/post/phishing/"
11  - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
12  - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
13  - "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/"
14severity: "medium"
15source: |
16  type.inbound
17
18  // Not from MS as the device code will be generated and sent by the attacker
19  and sender.email.domain.root_domain not in~ ("microsoft.com", "microsoftonline.com")
20
21  // Link to the device code MS pages
22  and any(body.links,
23          (
24            .href_url.url == "https://microsoft.com/devicelogin"
25            or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
26            or .href_url.url == "https://aka.ms/devicelogin"
27          )
28  )
29
30  // Body text references device codes
31  and (
32    strings.icontains(body.html.display_text, "device code")
33    or 
34    // A nine character string containing a combination of letters and characters
35    regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
36  )
37  and (
38    not profile.by_sender().solicited
39    or (
40      profile.by_sender().any_messages_malicious_or_spam
41      and not profile.by_sender().any_false_positives
42    )
43  )  
44attack_types:
45  - "Credential Phishing"
46tactics_and_techniques:
47  - "Impersonation: Brand"
48  - "Social engineering"
49detection_methods:
50  - "Content analysis"
51  - "Sender analysis"
52  - "URL analysis"
53id: "61f3ae67-c05c-506f-bbfe-764108a40974"