Microsoft Device Code Phishing

 1name: "Microsoft Device Code Phishing"
 2description: |
 3  An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.
 4
 5  This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.  
 6type: "rule"
 7authors:
 8  - twitter: "ajpc500"
 9references:
10  - "https://aadinternals.com/post/phishing/"
11  - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
12  - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
13severity: "medium"
14source: |
15  type.inbound
16
17  // Not from MS as the device code will be generated and sent by the attacker
18  and sender.email.domain.root_domain not in~ ("microsoft.com", "microsoftonline.com")
19
20  // Link to the device code MS pages
21  and any(body.links,
22          (
23            .href_url.url == "https://microsoft.com/devicelogin"
24            or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
25          )
26  )
27
28  // Body text references device codes
29  and (
30    strings.icontains(body.html.display_text, "device code")
31    or 
32    // A nine character string containing a combination of letters and characters
33    regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
34  )
35
36  // Unsolicited
37  and (
38    (
39      sender.email.domain.root_domain in $free_email_providers
40      and sender.email.email not in $recipient_emails
41    )
42    or (
43      sender.email.domain.root_domain not in $free_email_providers
44      and sender.email.domain.domain not in $recipient_domains
45    )
46  )  
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Impersonation: Brand"
51  - "Social engineering"
52detection_methods:
53  - "Content analysis"
54  - "Sender analysis"
55  - "URL analysis"
56id: "61f3ae67-c05c-506f-bbfe-764108a40974"