Steal Application Access Token — Business Email Compromise via OAuth Device Code Flow Phishing

// THREAT: OAuth Device Code Flow BEC Phishing
// Detects suspicious OAuth token acquisition via device code flow in Microsoft 365
// Primary telemetry: Azure AD Sign-in logs, Office 365 audit logs

// Alert 1: Device code flow sign-ins from anomalous locations or user agents
let KnownMobileApps = dynamic(["Microsoft Office", "Microsoft Teams", "Outlook Mobile", "OneDrive"]);
let SuspiciousUserAgents = dynamic(["python-requests", "curl", "wget", "Go-http-client", "okhttp", "axios"]);
AADSignInLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol =~ "deviceCode" or TokenIssuerType =~ "AzureAD"
| where ResourceDisplayName !in ("Windows Sign In", "Microsoft App Access Panel")
// Flag device code logins from suspicious clients or unexpected locations
| where UserAgent has_any (SuspiciousUserAgents)
    or (
      // Device code used and then token immediately used from different country than user's typical location
      Status.errorCode == 0 and
      (
        // Inline phishing sequence: initial device code poll + immediate use
        AuthenticationDetails has "DeviceCode" and
        Location !in ("GB", "US") // Adjust to your expected user country list
      )
    )
| project TimeGenerated, UserPrincipalName, IPAddress, Location, UserAgent,
    AppDisplayName, ResourceDisplayName, AuthenticationProtocol,
    ConditionalAccessStatus, RiskDetail, RiskLevelDuringSignIn
| extend ThreatType = "DeviceCode_BEC_Phishing"
| sort by TimeGenerated desc;
// Alert 2: Inbox rules created immediately after device code sign-in (typical BEC follow-on)
OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| where Parameters has_any ("DeleteMessage", "ForwardTo", "RedirectTo",
    "ForwardAsAttachmentTo", "MoveToFolder")
| where Parameters !has "Junk Email" // Exclude Junk folder rules which are often legitimate
| project TimeGenerated, UserId, ClientIP, Operation, Parameters, OrganizationId
| extend ThreatType = "BEC_InboxRule_Forwarding"

index=o365 sourcetype="o365:management:activity"
(
  (Operation="UserLoggedIn" AND AuthenticationDetails="*deviceCode*")
  OR Operation IN ("New-InboxRule", "Set-InboxRule")
)
| eval device_code=if(Operation="UserLoggedIn" AND match(AuthenticationDetails, "(?i)deviceCode"), "true", "false")
| eval inbox_rule_fwd=if(
    Operation IN ("New-InboxRule", "Set-InboxRule") AND
    match(Parameters, "(?i)(ForwardTo|DeleteMessage|RedirectTo|ForwardAsAttachmentTo)"),
    "true", "false"
  )
| where device_code="true" OR inbox_rule_fwd="true"
| stats
    count AS Events,
    values(Operation) AS Operations,
    values(ClientIP) AS IPs,
    values(AuthenticationDetails) AS AuthDetails,
    values(Parameters) AS RuleParams
  BY UserId, _time span=4h
| where mvcount(Operations) > 1 OR inbox_rule_fwd="true"
| eval ThreatType="BEC_DeviceCode_OAuthPhishing"
| eval ThreatActors="Scattered Spider, Storm-2372, Midnight Blizzard"
| sort - Events

sequence by user.name with maxspan=4h
  [authentication where event.action == "user-login" and
   event.dataset == "azure.signinlogs" and
   azure.signinlogs.properties.authentication_protocol == "deviceCode" and
   event.outcome == "success"]
  [file where event.dataset == "o365.audit" and
   event.action in ("New-InboxRule", "Set-InboxRule") and
   o365.audit.Parameters : ("*ForwardTo*", "*DeleteMessage*", "*RedirectTo*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS Username,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "Operation",
  "AuthenticationDetails",
  "Parameters",
  CASE
    WHEN "Operation" = 'UserLoggedIn' AND "AuthenticationDetails" ILIKE '%deviceCode%' THEN 'DEVICE_CODE_AUTH'
    WHEN "Operation" IN ('New-InboxRule', 'Set-InboxRule') AND "Parameters" ILIKE '%ForwardTo%' THEN 'INBOX_FORWARD_RULE'
    WHEN "Operation" IN ('New-InboxRule', 'Set-InboxRule') AND "Parameters" ILIKE '%DeleteMessage%' THEN 'INBOX_DELETE_RULE'
    ELSE 'OTHER'
  END AS DetectionType
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND starttime > NOW() - 86400000
  AND (
    ("Operation" = 'UserLoggedIn' AND "AuthenticationDetails" ILIKE '%deviceCode%')
    OR (
      "Operation" IN ('New-InboxRule', 'Set-InboxRule')
      AND ("Parameters" ILIKE '%ForwardTo%' OR "Parameters" ILIKE '%DeleteMessage%' OR "Parameters" ILIKE '%RedirectTo%')
    )
  )
ORDER BY starttime DESC

(_sourceCategory="o365" OR _sourceCategory="azure/signin")
| json field=_raw "Operation", "UserId", "ClientIP", "AuthenticationDetails", "Parameters", "UserAgent", "Location", "AppDisplayName", "ResourceDisplayName" nodrop
| where Operation in ("UserLoggedIn", "New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| eval device_code = if(Operation = "UserLoggedIn" AND matches(AuthenticationDetails, "(?i)deviceCode"), "true", "false")
| eval suspicious_agent = if(matches(UserAgent, "(?i)(python-requests|curl|wget|Go-http-client|okhttp|axios)"), "true", "false")
| eval inbox_rule_fwd = if(
    Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox") AND
    matches(Parameters, "(?i)(ForwardTo|DeleteMessage|RedirectTo|ForwardAsAttachmentTo|MoveToFolder)") AND
    !matches(Parameters, "(?i)Junk Email"),
    "true", "false"
  )
| where device_code = "true" OR inbox_rule_fwd = "true"
| where suspicious_agent = "true" OR inbox_rule_fwd = "true" OR (device_code = "true" AND Location not in ("GB", "US"))
| timeslice 4h
| stats
    count as Events,
    values(Operation) as Operations,
    values(ClientIP) as IPs,
    values(AuthenticationDetails) as AuthDetails,
    values(Parameters) as RuleParams,
    values(UserAgent) as UserAgents,
    values(Location) as Locations
  by UserId, _timeslice
| where Events > 1 OR inbox_rule_fwd = "true"
| fields UserId, _timeslice, Events, Operations, IPs, AuthDetails, RuleParams, UserAgents, Locations
| sort by Events desc

rule bec_oauth_device_code_phishing {
  meta:
    author = "df00tech"
    description = "Detects OAuth Device Code Flow BEC phishing in Microsoft 365: device code authentication from suspicious clients or anomalous locations, and post-compromise inbox forwarding rule creation. Threat actors: Scattered Spider, Storm-2372, Midnight Blizzard."
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1078/004/"
    mitre_attack_tactic = "Initial Access, Persistence"
    mitre_attack_technique = "T1078.004, T1114.003"

  events:
    // Event 1: Device code flow sign-in with suspicious user agent or anomalous location
    (
      $e1.metadata.event_type = "USER_LOGIN"
      AND (
        re.regex($e1.network.http.user_agent, `(?i)(python-requests|curl|wget|Go-http-client|okhttp|axios)`)
        OR (
          $e1.extensions.auth.auth_details = "deviceCode"
          AND NOT re.regex($e1.principal.location.country_or_region, `(?i)^(United Kingdom|United States)$`)
        )
      )
      AND $e1.extensions.auth.auth_details = "deviceCode"
      AND $e1.target.application = /(?i)(Microsoft|Office|Teams|SharePoint|OneDrive|Exchange)/
      AND $user = $e1.principal.user.userid
    )
    OR
    // Event 2: Inbox forwarding or deletion rule created (post-BEC follow-on)
    (
      $e2.metadata.event_type = "EMAIL_TRANSACTION"
      AND re.regex($e2.metadata.description, `(?i)(New-InboxRule|Set-InboxRule|Set-Mailbox)`)
      AND re.regex($e2.about.labels["Parameters"], `(?i)(ForwardTo|DeleteMessage|RedirectTo|ForwardAsAttachmentTo|MoveToFolder)`)
      AND NOT re.regex($e2.about.labels["Parameters"], `(?i)Junk Email`)
      AND $user = $e2.principal.user.userid
    )

  match:
    $user over 4h

  condition:
    $e1 and $e2
}

// BEC: OAuth Device Code Flow Phishing Detection
// Covers: device code sign-ins from suspicious agents + inbox rule forwarding follow-on

#repo=base_activity
(
  // Branch 1: Device code authentication with suspicious user agent
  (
    AuthenticationProtocol = "deviceCode"
    OR TokenIssuerType = "AzureAD"
  )
  AND (
    UserAgent = /(?i)(python-requests|curl|wget|Go-http-client|okhttp|axios)/
    OR (
      AuthenticationDetails = /(?i)deviceCode/
      AND Location != /(?i)^(GB|US)/
    )
  )
  AND EventType IN ["UserLoggedIn", "AzureADSignIn"]
| groupBy(
    [UserId, UserAgent, Location, AppDisplayName, IPAddress],
    function=[
      count(aid, as=DeviceCodeEvents),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen),
      collect(IPAddress, as=IPs),
      collect(UserAgent, as=Agents)
    ]
  )
| eval ThreatType = "DeviceCode_BEC_Phishing"
| eval ThreatActors = "Scattered Spider, Storm-2372, Midnight Blizzard"
| sort(DeviceCodeEvents, order=desc)
)

UNION

(
  // Branch 2: Inbox forwarding/deletion rules created post-compromise
  Operation IN ["New-InboxRule", "Set-InboxRule", "Set-Mailbox"]
  AND Parameters = /(?i)(ForwardTo|DeleteMessage|RedirectTo|ForwardAsAttachmentTo|MoveToFolder)/
  AND Parameters != /(?i)Junk Email/
  AND EventSource = "O365"
| groupBy(
    [UserId, ClientIP, Operation],
    function=[
      count(aid, as=RuleEvents),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen),
      collect(Parameters, as=RuleParams),
      collect(ClientIP, as=IPs)
    ]
  )
| eval ThreatType = "BEC_InboxRule_Forwarding"
| eval ThreatActors = "Scattered Spider, Storm-2372, Midnight Blizzard"
| sort(RuleEvents, order=desc)
)