Detection rules › Sublime MQL

Microsoft device code phishing

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account. This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound

// Not from MS as the device code will be generated and sent by the attacker
and sender.email.domain.root_domain not in~ (
  "microsoft.com",
  "microsoftonline.com"
)

// Link to the device code MS pages
and any(body.links,
        (
          .href_url.url == "https://microsoft.com/devicelogin"
          or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
          or .href_url.url == "https://aka.ms/devicelogin"
        )
)

// Body text references device codes
and (
  strings.icontains(body.html.display_text, "device code")
  or 
  // A nine character string containing a combination of letters and characters
  regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Detection logic

Scope: inbound message.

An attacker may generate a user code and send it to a target mailbox. With an appropriate lure, the targeted user may action the device code login and provide an attacker with the means to take over their account. This rule looks for the presence of the Microsoft device login portal link, as well as mentions of 'device code' or a 9 character alphanumeric device code value.

  1. inbound message
  2. sender.email.domain.root_domain not in ('microsoft.com', 'microsoftonline.com')
  3. any of body.links where any holds:
    • .href_url.url is 'https://microsoft.com/devicelogin'
    • .href_url.url is 'https://login.microsoftonline.com/common/oauth2/deviceauth'
    • .href_url.url is 'https://aka.ms/devicelogin'
  4. any of:
    • body.html.display_text contains 'device code'
    • body.html.display_text matches '[\\W]([A-Z0-9]{9})[\\W]'
  5. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign

Inspects: body.html.display_text, body.links, body.links[].href_url.url, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.icontains.

Indicators matched (7)

FieldMatchValue
sender.email.domain.root_domainmembermicrosoft.com
sender.email.domain.root_domainmembermicrosoftonline.com
body.links[].href_url.urlequalshttps://microsoft.com/devicelogin
body.links[].href_url.urlequalshttps://login.microsoftonline.com/common/oauth2/deviceauth
body.links[].href_url.urlequalshttps://aka.ms/devicelogin
strings.icontainssubstringdevice code
regex.icontainsregex[\W]([A-Z0-9]{9})[\W]