High-Risk User Reveals Device Code Phishing

let target_user = "denis@example.com";
AADUserRiskEvents
| where TimeGenerated >= ago(7d)
| where UserPrincipalName =~ target_user
| where RiskLevel in~ ("medium", "high")
| where RiskState in~ ("atRisk", "confirmedCompromised")
| project
    TimeGenerated,
    ActivityDateTime,
    DetectedDateTime,
    UserPrincipalName,
    UserId,
    IpAddress,
    RiskEventType,
    RiskLevel,
    RiskState,
    RiskDetail,
    DetectionTimingType,
    Activity,
    CorrelationId,
    RequestId
| order by TimeGenerated asc

index=<entra_risk_index> sourcetype=<entra_user_risk_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, user_principal_name)),
    src=coalesce(src, IpAddress, ip_address),
    risk_type=coalesce(risk_type, RiskEventType),
    risk_level=lower(coalesce(risk_level, RiskLevel)),
    risk_state=lower(coalesce(risk_state, RiskState)),
    correlation_id=coalesce(correlation_id, CorrelationId),
    request_id=coalesce(request_id, RequestId)
| where user="denis@example.com"
    AND risk_level IN ("medium","high")
    AND risk_state IN ("atrisk","confirmedcompromised")
| table _time user src risk_type risk_level risk_state correlation_id request_id
| sort 0 _time

let target_user = "denis@example.com";
SigninLogs
| where TimeGenerated >= ago(7d)
| where UserPrincipalName =~ target_user
| where AuthenticationProtocol =~ "deviceCode"
| where tostring(ResultType) == "0"
| project
    TimeGenerated,
    UserPrincipalName,
    IPAddress,
    AuthenticationProtocol,
    AuthenticationRequirement,
    RiskLevelDuringSignIn,
    RiskLevelAggregated,
    RiskState,
    AppDisplayName,
    AppId,
    ResourceDisplayName,
    ConditionalAccessStatus,
    DeviceDetail,
    AutonomousSystemNumber,
    CorrelationId,
    SessionId
| order by TimeGenerated asc

index=<entra_signin_index> sourcetype=<entra_signin_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, user_principal_name)),
    src=coalesce(src, IPAddress, ip_address),
    auth_protocol=lower(coalesce(auth_protocol, AuthenticationProtocol)),
    result=coalesce(result, ResultType),
    signin_risk=lower(coalesce(signin_risk, RiskLevelDuringSignIn, RiskLevelAggregated)),
    risk_state=lower(coalesce(risk_state, RiskState)),
    app_name=coalesce(app_name, AppDisplayName),
    session_id=coalesce(session_id, SessionId),
    correlation_id=coalesce(correlation_id, CorrelationId)
| where user="denis@example.com" AND auth_protocol="devicecode" AND tostring(result)="0"
| table _time user src auth_protocol signin_risk risk_state app_name session_id correlation_id
| sort 0 _time

let target_user = "denis@example.com";
EntraIdSigninEvents
| where Timestamp >= ago(7d)
| where AccountUpn =~ target_user
| where ErrorCode in (0, 50199)
| summarize
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    ErrorCodes=make_set(ErrorCode),
    IPAddresses=make_set(IPAddress, 20),
    RiskLevels=make_set(RiskLevelDuringSignin, 10),
    Applications=make_set(Application, 20)
    by AccountUpn, CorrelationId, SessionId
| where ErrorCodes has_all (0, 50199)
| extend Duration=LastSeen-FirstSeen
| where Duration <= 5m
| order by FirstSeen asc

index=<entra_signin_index> sourcetype=<defender_entra_signin_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, AccountUpn)),
    error_code=coalesce(error_code, ErrorCode),
    correlation_id=coalesce(correlation_id, CorrelationId),
    session_id=coalesce(session_id, SessionId),
    src=coalesce(src, IPAddress)
| where user="denis@example.com" AND error_code IN (0,50199)
| stats
    min(_time) as first_seen
    max(_time) as last_seen
    values(error_code) as error_codes
    values(src) as source_ips
    values(RiskLevelDuringSignin) as risk_levels
    by user correlation_id session_id
| eval duration=last_seen-first_seen
| where mvfind(error_codes,"50199")>=0 AND mvfind(error_codes,"0")>=0 AND duration<=300
| convert ctime(first_seen) ctime(last_seen)
| sort 0 first_seen

let target_user = "denis@example.com";
CloudAppEvents
| where Timestamp >= ago(7d)
| where AccountObjectId != ""
| extend UserPrincipalName = tolower(tostring(RawEventData.ObjectId))
| where UserPrincipalName == tolower(target_user)
    or AccountDisplayName =~ target_user
| where AccountDisplayName == "Device Registration Service"
    or ActionType in (
        "New-InboxRule",
        "Set-InboxRule",
        "Enable-InboxRule",
        "UpdateInboxRules",
        "MailItemsAccessed"
    )
| project
    Timestamp,
    AccountDisplayName,
    ActionType,
    ApplicationId,
    IPAddress,
    UncommonForUser,
    ActivityObjects,
    RawEventData
| order by Timestamp asc

index=<cloud_app_index> sourcetype=<cloud_app_events_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, AccountDisplayName)),
    action=coalesce(action, ActionType),
    app_id=coalesce(app_id, ApplicationId),
    src=coalesce(src, IPAddress)
| where user="denis@example.com"
    AND (
        action IN ("New-InboxRule","Set-InboxRule","Enable-InboxRule","UpdateInboxRules","MailItemsAccessed")
        OR AccountDisplayName="Device Registration Service"
    )
| fields _time user src action app_id AccountDisplayName UncommonForUser ActivityObjects RawEventData
| sort 0 _time