Tycoon2FA: Microsoft 365 Device Code Phishing and Trustifi Abuse — Detection and Hardening

---
title: Potential Tycoon2FA Device Code Login
id: b7e8d9f0-1a2b-3c4d-5e6f-7a8b9c0d1e2f
status: experimental
description: Detects sign-ins using the Device Code authentication flow, often abused by Tycoon2FA. While legitimate for some Linux/CLI tools, it is rare for typical user workstations.
references:
  - https://attack.mitre.org/techniques/T1552.001/
  - https://www.bleepingcomputer.com/news/security/tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing/
author: Security Arsenal
date: 2025/04/03
tags:
  - attack.credential_access
  - attack.t1528
logsource:
  product: azure
  service: sign_in_logs
detection:
  selection:
    AuthenticationDetails|contains: 'deviceCode'
  filter_legit_apps:
    AppDisplayName|contains:
      - 'Azure CLI'
      - 'Azure PowerShell'
      - 'Microsoft Teams'
  condition: selection and not filter_legit_apps
falsepositives:
  - Legitimate use of Azure CLI or PowerShell modules on non-Windows workstations
level: high
---
title: Tycoon2FA Network Indicator - Device Code Endpoint
id: c9f0e1d2-3b4c-5d6e-7f8a-9b0c1d2e3f4a
status: experimental
description: Detects processes contacting the Microsoft device code endpoint, indicative of phishing kit tooling running on the network or an endpoint.
references:
  - https://www.bleepingcomputer.com/news/security/tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing/
author: Security Arsenal
date: 2025/04/03
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: 'login.microsoftonline.com'
    RequestURI|contains: '/devicecode'
  filter_browser:
    Image|contains:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter_browser
falsepositives:
  - Administrators using Azure PowerShell or CLI
level: medium


**KQL (Microsoft Sentinel / Defender):**

// Hunt for Device Code Logins
SigninLogs
| where AuthenticationDetails has "deviceCode"
| extend AppName = AppDisplayName, DeviceId = DeviceDetail.deviceId, Browser = DeviceDetail.browser
| project TimeGenerated, UserPrincipalName, AppName, IPAddress, Location, ResultDescription, Browser, DeviceId
| order by TimeGenerated desc

// Correlate with Risky Sign-ins
SigninLogs
| where AuthenticationDetails has "deviceCode"
| join kind=inner RiskyUsers on UserPrincipalName
| project TimeGenerated, UserPrincipalName, RiskLevel, RiskDetail, IPAddress


**Velociraptor VQL:**

-- Hunt for processes contacting Microsoft Device Code endpoint
SELECT Pid, Name, CommandLine, Exe, Username
FROM process_dns_lookup()
WHERE Fqdn =~ 'login.microsoftonline.com'

-- Hunt for network connections to the specific endpoint
SELECT RemoteAddress, RemotePort, Pid, Name, Username
FROM netstat()
WHERE RemoteAddress =~ 'login.microsoftonline.com'
  AND Pid IN (SELECT Pid FROM pslist() WHERE Name NOT IN ('chrome.exe', 'msedge.exe', 'firefox.exe'))


**Remediation Script (PowerShell):**

# requires AzureAD or Microsoft.Graph module
# Connect-AzureAD (Run as Admin)

Write-Host "Auditing Conditional Access Policies for Device Code Flow restrictions..." -ForegroundColor Cyan

$Policies = Get-AzureADMSConditionalAccessPolicy

$DeviceCodePolicies = $Policies | Where-Object { 
    $_.Conditions.ClientAppTypes -contains "All" -or 
    $_.Conditions.ClientAppTypes -contains "EAS" -or 
    $_.State -eq "enabled" 
}

$Found = $false
foreach ($Policy in $DeviceCodePolicies) {
    # Check if the policy restricts 'Other' client types or specifically targets device code flows via grant controls
    # Device Code flow is often filtered by blocking 'Exchange ActiveSync' or 'Other' clients if not explicitly handled
    # or by requiring Compliant Device/Workplace Joined conditions which device code often fails to provide.
    
    $Controls = $Policy.GrantControls.BuiltInControls
    $Conditions = $Policy.Conditions
    
    if ($Controls -contains "block" -and $Conditions.Locations -ne $null) {
        Write-Host "[!] Found Blocking Policy: $($Policy.DisplayName)" -ForegroundColor Yellow
        Write-Host "    State: $($Policy.State)"
        Write-Host "    User Targeting: $($Policy.Conditions.Users.IncludeSgp.Length) groups"
        $Found = $true
    }
}

if (-not $Found) {
    Write-Host "WARNING: No explicit blocking Conditional Access policies detected for legacy/client flows." -ForegroundColor Red
    Write-Host "ACTION REQUIRED: Create a CA policy blocking Device Code flow or restricting legacy authentication." -ForegroundColor Red
}