OAuth Device Code Authentication Flow Used for Sign-in (EvilTokens/ARToken Style

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.