Detection rules › Kusto
Detect device code login with user risk
Threat actors regularly use Device Code authentication to login into compromised accounts. Popular attacks for this are using device code phishing attacks for example. Even though every organization should block device code authentication in conditional access, you can create a fall-back detection rule to flag device code logins by risky users.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
References
Telemetry coverage
Rule body
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1h)
| where ResultSignature =~ "SUCCESS"
| where AuthenticationProtocol =~ "deviceCode"
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName
Stages and Predicates
Stage 1: union
union of 2 branches
Stage 2: source
SigninLogs
Stage 3: source
AADNonInteractiveUserSignInLogs
Stage 4: where
where TimeGenerated > ago(3600s)
Stage 5: where
where ResultSignature =~ "SUCCESS"
Stage 6: where
where AuthenticationProtocol =~ "deviceCode"
Stage 7: join
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AuthenticationProtocol | eq |
| field:"AuthenticationProtocol" kind:eq value:"deviceCode" |
ResultSignature | eq |
| field:"ResultSignature" kind:eq value:"SUCCESS" |