sublimemediumRule

Microsoft device code phishing

An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account. This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound

// Not from MS as the device code will be generated and sent by the attacker
and sender.email.domain.root_domain not in~ (
  "microsoft.com",
  "microsoftonline.com"
)

// Link to the device code MS pages
and any(body.links,
        (
          .href_url.url == "https://microsoft.com/devicelogin"
          or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
          or .href_url.url == "https://aka.ms/devicelogin"
        )
)

// Body text references device codes
and (
  strings.icontains(body.html.display_text, "device code")
  or 
  // A nine character string containing a combination of letters and characters
  regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Author

ajpc500

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

Raw Content

name: "Microsoft device code phishing"
description: |
  An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account.

  This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.
type: "rule"
authors:
  - twitter: "ajpc500"
references:
  - "https://aadinternals.com/post/phishing/"
  - "https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html"
  - "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html"
  - "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/"
severity: "medium"
source: |
  type.inbound
  
  // Not from MS as the device code will be generated and sent by the attacker
  and sender.email.domain.root_domain not in~ (
    "microsoft.com",
    "microsoftonline.com"
  )
  
  // Link to the device code MS pages
  and any(body.links,
          (
            .href_url.url == "https://microsoft.com/devicelogin"
            or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
            or .href_url.url == "https://aka.ms/devicelogin"
          )
  )
  
  // Body text references device codes
  and (
    strings.icontains(body.html.display_text, "device code")
    or 
    // A nine character string containing a combination of letters and characters
    regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
  - "URL analysis"
id: "61f3ae67-c05c-506f-bbfe-764108a40974"