python-requests OAuth device code abuse against Microsoft endpoints

Ibrahim Saud@tektrix

•updated 22 days ago•2•0•6

Detects Python processes (python.exe, python3.exe, pythonw.exe) performing DNS resolution for Microsoft identity, device login, or Graph API endpoints. This activity is consistent with automated tooling, such as python-requests, performing device-code flow polling or API token authentication within an environment.