Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Identity Analytics |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
An Azure AD login was performed with Device code flow.
Attacker's Goals
- An attacker may use a device to access resources in the tenant using an access token from device code authentication flows.
Investigative actions
- Check what devices are listed with the logged-in user.
- Check if the account is authorized to use such devices to access resources.
- Check for possible logins from the device.
- Follow further actions done by the account and device.
Variations
Suspicious Azure device code authentication flow used by an Azure AD privileged userSuspicious Azure device code authentication flow used
Azure device code authentication flow used by an Azure AD privileged user