Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1528-steal-application-access-token

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects Entra ID token refresh activity following device code flow authentication that indicates ongoing access from an account compromise.

Strategy

This rule monitors Entra ID non-interactive sign-in logs following device code flow authentication that indicates ongoing access from an account compromise. Two conditions are evaluated. The first triggers when @properties.deviceDetail.displayName matches non-standard default Windows hostname pattern, associated with known device code phishing services. The second triggers when the successful token refresh is observed from the Microsoft Authentication Broker or Microsoft Office, applications commonly abused by device code phishing services.

Triage and response

• Examine the device details in @properties.deviceDetail.displayName and @properties.deviceDetail.deviceId to determine whether the session originates from a known corporate endpoint.
• Identify the user account {{@ocsf.actor.user.email_addr}} associated with the token refresh and verify whether they recently completed a device code authentication prompt.
• Review the application and resource accessed using @properties.appId and @properties.resourceId to understand which cloud resources the refreshed token is being used to reach.
• Determine whether other token refresh events from the same @properties.deviceDetail.deviceId or @ocsf.src_endpoint.ip occurred across additional user accounts in the surrounding time window.
• Review earlier sign-in events for {{@ocsf.actor.user.email_addr}} where @properties.authenticationProtocol is deviceCodeFlow to reconstruct the initial compromise timeline.