LoFP / a user authenticating via the device code flow for the first time from a new but legitimate network, such as travel, a new home or office isp, a corporate vpn, or a mobile carrier. device code authentication is expected when enrolling or signing in on input-constrained devices (smart tvs, kiosks, iot, conference room devices) and for some cli or headless developer workflows. review the source asn, geolocation, and the user's prior device code history to confirm whether the origin is plausible before escalating.

Techniques

• T1078
• T1550
• T1566

Sample rules

M365 Identity Device Code Grant with Unusual User and ASN

• source: elastic
• technicques:
  • T1078
  • T1550
  • T1566

Description

Identifies a Microsoft 365 OAuth device code grant (“Cmsi:Cmsi”) with application Microsoft Authentication Broker (“29d9ed98-a469-4536-ade2-f981bc1d605e”) for Microsoft Graph from a source ASN not previously observed for that user in a historical window. Phishing kits leveraging device code phishing complete the full login (password and MFA) at the genuine Microsoft endpoint and harvest the resulting token by polling, so MFA does not stop them and the authorization commonly originates from attacker-controlled residential proxy or hosting infrastructure rather than the user’s normal network.

Detection logic

event.dataset: "o365.audit"
    and o365.audit.ExtendedProperties.RequestType: "Cmsi:Cmsi"
    and o365.audit.Actor.Type: (0 or 2 or 3 or 5 or 10)
    and o365.audit.ApplicationId: "29d9ed98-a469-4536-ade2-f981bc1d605e"
    and o365.audit.Target.ID: "00000003-0000-0000-c000-000000000000"
    and o365.audit.DeviceProperties.Value: "False"