Suspicious Application Via Device Code Authentication Flow (via signinlogs)

title: Suspicious Application Via Device Code Authentication Flow (via signinlogs)
id: cc62a3bc-bff7-5a63-b336-74f44dd9c555
status: stable
description: This rule detects device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Huntrule Team
date: 2026-03-02
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: Device Code
    condition: selection
falsepositives:
    - Unknown
level: medium