Application Using Device Code Authentication Flow — Sigma Rule

Rule metadata and linked tags

Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'. Source status: test; severity: medium. Source dates: 2022-06-01 / not supplied.

{
  "product": "azure",
  "service": "signinlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 86b77dcf54abe01d3a9eaeed7532ebbece4059f9b232ad62c061f40df356e51f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Application Using Device Code Authentication Flow
id: 248649b7-d64f-46f0-9fb2-a52774166fb5
status: test
description: |
    Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
    If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
    This can be a misconfigured application or potentially something malicious.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-01
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: Device Code
    condition: selection
falsepositives:
    - Applications that are input constrained will need to use device code flow and are valid authentications.
level: medium

Original YAML and metadata in JSON

False positives

• Applications that are input constrained will need to use device code flow and are valid authentications.

Source references

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows