Microsoft OAuth Device Code Authorization Grant Abuse

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•2

This rule detects successful authentication events using the Microsoft OAuth device code flow, which is often abused in phishing campaigns to hijack user sessions. It flags authentication attempts that match specific device authorization URLs, include signs of bypassing security warnings, or indicate a lack of direct user authentication interaction.