Non-interactive sign-in with python-requests UA after device code auth

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.