Elastic Security Detection Rules

Entra ID OAuth Device Code Grant by Unusual User

Last updated 13 days ago on 2026-02-26
Created a year ago on 2024-10-14

About

Identifies when a user is observed for the first time authenticating using the device code authentication workflow. This authentication workflow can be abused by attackers to phish users and steal access tokens to impersonate the victim. By its very nature, device code should only be used when logging in to devices without keyboards, where it is difficult to enter emails and passwords. This rule only applies to Entra ID user types and detects new users leveraging this flow.
Tags
Domain: CloudDomain: IdentityData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Sign-In LogsUse Case: Identity and Access AuditTactic: Initial AccessLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Phishing (T1566)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-azure.signinlogs-*logs-azure.activitylogs-*
Related Integrations

azure(external, opens in a new tab or window)

Query
text code block:
event.dataset:(azure.activitylogs or azure.signinlogs)
    and (
            azure.signinlogs.properties.authentication_protocol:deviceCode or
            azure.signinlogs.properties.original_transfer_method:deviceCodeFlow or
            azure.activitylogs.properties.authentication_protocol:deviceCode
        )
    and event.outcome:success
    and azure.signinlogs.properties.user_type:*
    and not azure.signinlogs.properties.app_id:(
        "29d9ed98-a469-4536-ade2-f981bc1d605e" or
        "d5a56ea4-7369-46b8-a538-c370805301bf" or
        "80faf920-1908-4b52-b5ef-a8e7bedfc67a" or
        "97877f11-0fc6-4aee-b1ff-febb0519dd00" or
        "245e1dee-74ef-4257-a8c8-8208296e1dfd" or
        "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223" or
        "74bcdadc-2fdc-4bb3-8459-76d06952a0e9" or
        "4813382a-8fa7-425e-ab75-3b753aab3abb" or
        "a850aaae-d5a5-4e82-877c-ce54ff916282"
    )

Install detection rules in Elastic Security

Detect Entra ID OAuth Device Code Grant by Unusual User in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).