Device Code Auth Then Registration
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
YARA-L

Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.

Already have an account?