Detect device code login with user risk

Group by: UserPrincipalName
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Threat actors regularly use Device Code authentication to login into compromised accounts. Popular attacks for this are using device code phishing attacks for example. Even though every organization should block device code authentication in conditional access, you can create a fall-back detection rule to flag device code logins by risky users.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

References

https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/

Telemetry coverage

Platform	Record / event type
Azure	any: Sign-in record (AADNonInteractiveUserSignInLogs, any result)
Entra ID	`SigninLogs` sign-in event: Sign-in record (SigninLogs, any result)

Rule body

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1h)
| where ResultSignature =~ "SUCCESS"
| where AuthenticationProtocol =~ "deviceCode"
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName

Stages and Predicates

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: SigninLogs, AADNonInteractiveUserSignInLogs

Leg 1: `SigninLogs`

Leg 2: `AADNonInteractiveUserSignInLogs`

Applied to the combined result

| where TimeGenerated > ago(1h) | where ResultSignature =~ "SUCCESS" | where AuthenticationProtocol =~ "deviceCode" | join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationProtocol`	eq	`deviceCode`	`field:"AuthenticationProtocol" kind:eq value:"deviceCode"`
`ResultSignature`	eq	`SUCCESS`	`field:"ResultSignature" kind:eq value:"SUCCESS"`