Azure Sign-in Logs: Application Using Device Code Authentication Flow

Alerts on Azure sign-in events showing "Device Code" usage by applications outside expected input-constrained device contexts.

FreeUnreviewedSigmamediumv1

azure-sign-in-logs-application-using-device-code-authentication-flow-248649b7

title: "Azure Sign-in Logs: Application Using Device Code Authentication Flow"
id: 837c6264-6610-49da-a547-fd2dd7d62abf
status: test
description: This rule flags sign-in events in Azure sign-in logs where the message contains "Device Code," indicating use of the OAuth device code authentication flow. Attackers may leverage this flow from applications outside typical input-constrained device scenarios to blend in or maintain stealthy access. It relies on the presence of the "Device Code" indicator in the sign-in message telemetry, and is intended to prompt investigation when device code flow appears unexpectedly.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-01
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    properties.message: Device Code
  condition: selection
falsepositives:
  - Applications that are input constrained will need to use device code flow and are valid authentications.
level: medium
license: DRL-1.1
related:
  - id: 248649b7-d64f-46f0-9fb2-a52774166fb5
    type: derived

What it detects

This rule flags sign-in events in Azure sign-in logs where the message contains "Device Code," indicating use of the OAuth device code authentication flow. Attackers may leverage this flow from applications outside typical input-constrained device scenarios to blend in or maintain stealthy access. It relies on the presence of the "Device Code" indicator in the sign-in message telemetry, and is intended to prompt investigation when device code flow appears unexpectedly.

Known false positives

Applications that are input constrained will need to use device code flow and are valid authentications.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.