Detection rules › Sublime MQL
Microsoft device code phishing
An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account. This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.html |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
// Not from MS as the device code will be generated and sent by the attacker
and sender.email.domain.root_domain not in~ (
"microsoft.com",
"microsoftonline.com"
)
// Link to the device code MS pages
and any(body.links,
(
.href_url.url == "https://microsoft.com/devicelogin"
or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
or .href_url.url == "https://aka.ms/devicelogin"
)
)
// Body text references device codes
and (
strings.icontains(body.html.display_text, "device code")
or
// A nine character string containing a combination of letters and characters
regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account. This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.
- inbound message
- sender.email.domain.root_domain not in ('microsoft.com', 'microsoftonline.com')
any of
body.linkswhere any holds:- .href_url.url is 'https://microsoft.com/devicelogin'
- .href_url.url is 'https://login.microsoftonline.com/common/oauth2/deviceauth'
- .href_url.url is 'https://aka.ms/devicelogin'
any of:
- body.html.display_text contains 'device code'
- body.html.display_text matches '[\\W]([A-Z0-9]{9})[\\W]'
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.html.display_text, body.links, body.links[].href_url.url, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.icontains.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | member | microsoft.com |
sender.email.domain.root_domain | member | microsoftonline.com |
body.links[].href_url.url | equals | https://microsoft.com/devicelogin |
body.links[].href_url.url | equals | https://login.microsoftonline.com/common/oauth2/deviceauth |
body.links[].href_url.url | equals | https://aka.ms/devicelogin |
strings.icontains | substring | device code |
regex.icontains | regex | [\W]([A-Z0-9]{9})[\W] |