Auth Error 50199 Followed by Success

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•5

Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.