---
title: Potential Device Code Flow Phishing Attempt
id: 1a2b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects sign-ins utilizing the Device Code Flow authentication method, which is often abused in phishing campaigns to bypass MFA.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/
 - https://attack.mitre.org/techniques/T1552/ (Unsecured Credentials)
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.credential_access
 - attack.t1552.001
logsource:
 product: azure
 service: sign_in_logs
detection:
 selection:
  AuthenticationMethod|contains: 'DeviceCodeFlow'
 filter:
  AppDisplayName|contains:
   - 'Microsoft Authenticator'
   - 'Office'
  DeviceDetail|contains: 'Compliant'
 condition: selection and not filter
falsepositives:
 - Legitimate sign-ins from IoT devices or smart TVs (rare in corporate environments)
level: medium
---
title: Device Code Initiation via Script or Suspicious User-Agent
id: 2b3c4d5e-6f78-9012-bcde-f12345678901
status: experimental
description: Detects processes initiating OAuth device code requests, indicative of attacker tooling or automation scripts.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
  DestinationHostname|contains: 'login.microsoftonline.com'
  DestinationPort: 443
  Initiated: 'true'
 filter_legit_browsers:
  Image|endswith:
   - '\chrome.exe'
   - '\msedge.exe'
   - '\firefox.exe'
 condition: selection and not filter_legit_browsers
falsepositives:
 - Legacy applications using device code flow legitimately
level: high

SigninLogs
| where AuthenticationDetails has "DeviceCodeFlow"
| extend RiskScore = coalesce(RiskScoreDuringSignIn, 0)
| project TimeGenerated, UserPrincipalName, AppDisplayName, AuthenticationDetails,
          IPAddress, DeviceDetail, RiskScore, ConditionalAccessStatus
| where ConditionalAccessStatus != "success"
| sort by TimeGenerated desc

-- Hunt for non-browser processes connecting to Microsoft Device Code endpoints
SELECT Pid, Name, Exe, CommandLine, Username, RemoteAddress, RemotePort
FROM chain(proc_entries=pslist(), net_connections=netstat())
WHERE RemoteAddress =~ 'login.microsoftonline.com'
  AND RemotePort == 443
  AND Name !~ '(chrome|firefox|msedge|opera|iexplorer)'
  AND Name =~ '(powershell|python|cmd|pwsh|cscript|wscript)'

# Audit Device Code Flow Sign-ins (Requires ExchangeOnlineManagement or Microsoft Graph module)
# Connect-MgGraph -Scopes "AuditLog.Read.All" , "Directory.Read.All"

Write-Host "Checking for recent Device Code Flow authentication attempts..." -ForegroundColor Cyan

$Date = (Get-Date).AddDays(-7)

# Retrieve Sign-in Logs for Device Code Flow
# Note: Adjust Filter based on available Graph beta/v1.0 endpoints for AuthenticationMethodDetails
$DeviceCodeSignins = Get-MgAuditLogSignIn -Filter "authenticationDetails/any(x: x/authenticationMethod eq 'DeviceCodeFlow') and createdDateTime gt $Date" -All

if ($DeviceCodeSignins) {
    Write-Host "[!] Found $($DeviceCodeSignins.Count) Device Code Flow sign-ins in the last 7 days." -ForegroundColor Red
    $DeviceCodeSignins | Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, @{N='IP Address';E={$_.IpAddress}}, AuthenticationRequirement | Export-Csv -Path ".\DeviceCodeFlow_Audit.csv" -NoTypeInformation
    Write-Host "Results exported to .\DeviceCodeFlow_Audit.csv" -ForegroundColor Yellow
} else {
    Write-Host "[+] No Device Code Flow sign-ins detected in the last 7 days." -ForegroundColor Green
}

# Remediation Guidance: Block Device Code Flow via Conditional Access
Write-Host "\nREMEDIATION STEP: To block this, create a Conditional Access Policy:" -ForegroundColor Yellow
Write-Host "1. Grant Controls: Block Access" -ForegroundColor White
Write-Host "2. Conditions: Filter for devices -> Filter devices: Device state equals 'Device Code Flow' (if available) or exclude all compliant/hybrid joined devices." -ForegroundColor White
Write-Host "3. Alternatively, restrict access to 'Browser' and 'Mobile apps and desktop clients' only." -ForegroundColor White