OfficeHome sign-in error 90014 with mismatched mobile UA on Windows OS
Detects anomalous sign-in attempts to the OfficeHome application that result in OAuth error 90014 (frequently associated with application access issues or invalid consent) combined with an implausible mismatch between the reported Windows 10 operating system and mobile-specific browser user agents (e.g., Mobile Safari, Chrome Mobile). This behavior may indicate an adversary attempting to mimic legitimate device traffic to bypass conditional access policies or facilitate OAuth-based token manipulation.
Sigma
