Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1528-steal-application-access-token

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects Microsoft 365 device code phishing where a pending device code sign-in is followed by a successful authentication through Microsoft Authentication Broker or OfficeHome.

Strategy

This rule monitors Microsoft 365 sign-in activity for the device code authentication sequence associated with credential phishing. It correlates a UserLoginFailed event with @ErrorNumber 50199, which indicates a device code is awaiting user approval, with a subsequent UserLoggedIn event where @ExtendedProperties.RequestType is Cmsi:Cmsi for the same user.

Device code phishing abuses the OAuth device authorization grant: an attacker starts the flow and obtains a user code, then tricks the victim into approving the sign-in at microsoft.com/devicelogin. The victim’s completed authentication issues tokens to the attacker’s session. Commonly abused first-party clients in this technique include Microsoft Authentication Broker and OfficeHome.

Triage & Response

• Contact {{@ocsf.actor.user.email_addr}} to determine whether they intentionally entered a device code at microsoft.com/devicelogin during the alert timeframe.
• Review the sign-in details for the pending and successful events, including {{@network.client.ip}}, geographic location, and client application name, and compare them to the user’s normal authentication patterns.
• Identify whether the user reported a phishing page, unsolicited login prompt, or MFA approval they did not initiate around the time of the alert.
• Examine sign-in and audit activity for {{@ocsf.actor.user.email_addr}} immediately after the successful device code authentication for mailbox access, file downloads, application consent, or privilege changes.
• Check for additional device code sign-ins across other users from the same {{@network.client.ip}} or similar client details to assess campaign scope.
• Revoke active sessions, remove any registered devices and reset credentials for {{@ocsf.actor.user.email_addr}} if the user did not authorize the device code authentication.