Application Using Device Code Authentication Flow
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
What it detects
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Applications that are input constrained will need to use device code flow and are valid authentications.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/sigma/sigma.azure_signin_logs_azure_app_device_code_authentication.yaml, licensed under the Detection Rule License 1.1.
id: sigma.azure_signin_logs_azure_app_device_code_authentication
version: 1.0.0
status: experimental
severity: medium
confidence: 0.6
platforms:
- application
mitre_techniques:
- T1078
description: |
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
match:
event_category: authentication
raw_message_any:
- Device Code
false_positive_guidance: Applications that are input constrained will need to use device code flow and are valid authentications.
Converted from the SigmaHQ rule “Application Using Device Code Authentication Flow” by Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', distributed under the Detection Rule License 1.1. Original rule.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.