Device-code / AiTM authentication flow abuse for identity compromise

Ibrahim Saud@tektrix

•updated Sep 18, 2026•11•0•5

This rule monitors successful user sign-ins using the 'deviceCode' authentication protocol that originate from an IP address previously unseen for that specific user within the last 24 hours. The Device Code flow is commonly targeted in phishing campaigns to bypass traditional credential-based MFA, making anomalous logins using this protocol a high-signal indicator of account compromise.