Business Email Compromise via OAuth Device Code Flow Phishing

// THREAT: OAuth Device Code Flow BEC Phishing
// Detects suspicious OAuth token acquisition via device code flow in Microsoft 365
// Primary telemetry: Azure AD Sign-in logs, Office 365 audit logs

// Alert 1: Device code flow sign-ins from anomalous locations or user agents
let KnownMobileApps = dynamic(["Microsoft Office", "Microsoft Teams", "Outlook Mobile", "OneDrive"]);
let SuspiciousUserAgents = dynamic(["python-requests", "curl", "wget", "Go-http-client", "okhttp", "axios"]);
AADSignInLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol =~ "deviceCode" or TokenIssuerType =~ "AzureAD"
| where ResourceDisplayName !in ("Windows Sign In", "Microsoft App Access Panel")
// Flag device code logins from suspicious clients or unexpected locations
| where UserAgent has_any (SuspiciousUserAgents)
    or (
      // Device code used and then token immediately used from different country than user's typical location
      Status.errorCode == 0 and
      (
        // Inline phishing sequence: initial device code poll + immediate use
        AuthenticationDetails has "DeviceCode" and
        Location !in ("GB", "US") // Adjust to your expected user country list
      )
    )
| project TimeGenerated, UserPrincipalName, IPAddress, Location, UserAgent,
    AppDisplayName, ResourceDisplayName, AuthenticationProtocol,
    ConditionalAccessStatus, RiskDetail, RiskLevelDuringSignIn
| extend ThreatType = "DeviceCode_BEC_Phishing"
| sort by TimeGenerated desc;
// Alert 2: Inbox rules created immediately after device code sign-in (typical BEC follow-on)
OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| where Parameters has_any ("DeleteMessage", "ForwardTo", "RedirectTo",
    "ForwardAsAttachmentTo", "MoveToFolder")
| where Parameters !has "Junk Email" // Exclude Junk folder rules which are often legitimate
| project TimeGenerated, UserId, ClientIP, Operation, Parameters, OrganizationId
| extend ThreatType = "BEC_InboxRule_Forwarding"

index=o365 sourcetype="o365:management:activity"
(
  (Operation="UserLoggedIn" AND AuthenticationDetails="*deviceCode*")
  OR Operation IN ("New-InboxRule", "Set-InboxRule")
)
| eval device_code=if(Operation="UserLoggedIn" AND match(AuthenticationDetails, "(?i)deviceCode"), "true", "false")
| eval inbox_rule_fwd=if(
    Operation IN ("New-InboxRule", "Set-InboxRule") AND
    match(Parameters, "(?i)(ForwardTo|DeleteMessage|RedirectTo|ForwardAsAttachmentTo)"),
    "true", "false"
  )
| where device_code="true" OR inbox_rule_fwd="true"
| stats
    count AS Events,
    values(Operation) AS Operations,
    values(ClientIP) AS IPs,
    values(AuthenticationDetails) AS AuthDetails,
    values(Parameters) AS RuleParams
  BY UserId, _time span=4h
| where mvcount(Operations) > 1 OR inbox_rule_fwd="true"
| eval ThreatType="BEC_DeviceCode_OAuthPhishing"
| eval ThreatActors="Scattered Spider, Storm-2372, Midnight Blizzard"
| sort - Events

sequence by user.name with maxspan=4h
  [authentication where event.action == "user-login" and
   event.dataset == "azure.signinlogs" and
   azure.signinlogs.properties.authentication_protocol == "deviceCode" and
   event.outcome == "success"]
  [file where event.dataset == "o365.audit" and
   event.action in ("New-InboxRule", "Set-InboxRule") and
   o365.audit.Parameters : ("*ForwardTo*", "*DeleteMessage*", "*RedirectTo*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS Username,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "Operation",
  "AuthenticationDetails",
  "Parameters",
  CASE
    WHEN "Operation" = 'UserLoggedIn' AND "AuthenticationDetails" ILIKE '%deviceCode%' THEN 'DEVICE_CODE_AUTH'
    WHEN "Operation" IN ('New-InboxRule', 'Set-InboxRule') AND "Parameters" ILIKE '%ForwardTo%' THEN 'INBOX_FORWARD_RULE'
    WHEN "Operation" IN ('New-InboxRule', 'Set-InboxRule') AND "Parameters" ILIKE '%DeleteMessage%' THEN 'INBOX_DELETE_RULE'
    ELSE 'OTHER'
  END AS DetectionType
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND starttime > NOW() - 86400000
  AND (
    ("Operation" = 'UserLoggedIn' AND "AuthenticationDetails" ILIKE '%deviceCode%')
    OR (
      "Operation" IN ('New-InboxRule', 'Set-InboxRule')
      AND ("Parameters" ILIKE '%ForwardTo%' OR "Parameters" ILIKE '%DeleteMessage%' OR "Parameters" ILIKE '%RedirectTo%')
    )
  )
ORDER BY starttime DESC