{"id":"248649b7-d64f-46f0-9fb2-a52774166fb5","title":"Application Using Device Code Authentication Flow","description":"Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\nIf this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\nThis can be a misconfigured application or potentially something malicious.\n","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"medium","date":"2022-06-01","modified":"","tags":["attack.stealth","attack.t1078","attack.persistence","attack.privilege-escalation","attack.initial-access"],"technique_ids":["T1078"],"logsource":{"product":"azure","service":"signinlogs"},"falsepositives":["Applications that are input constrained will need to use device code flow and are valid authentications."],"references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows"],"source_path":"rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml","source_sha256":"86b77dcf54abe01d3a9eaeed7532ebbece4059f9b232ad62c061f40df356e51f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Application Using Device Code Authentication Flow\nid: 248649b7-d64f-46f0-9fb2-a52774166fb5\nstatus: test\ndescription: |\n    Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\n    If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\n    This can be a misconfigured application or potentially something malicious.\nreferences:\n    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-01\ntags:\n    - attack.stealth\n    - attack.t1078\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\nlogsource:\n    product: azure\n    service: signinlogs\ndetection:\n    selection:\n        properties.message: Device Code\n    condition: selection\nfalsepositives:\n    - Applications that are input constrained will need to use device code flow and are valid authentications.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/248649b7-d64f-46f0-9fb2-a52774166fb5.json","kind":"sigma"}