Device Code Sign-In
Detects authentication events using the device code flow as identified by Microsoft Defender for Identity, where a user enters a code on a separate device to complete sign‑in. While commonly used for legitimate scenarios, this method can be abused by attackers to perform phishing‑based authentication or bypass traditional sign‑in monitoring
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
|#event.dataset="defender-identity.IdentityLogonEvents"
|Vendor.properties.LogonType ="Cmsi:Cmsi"
|table([@timestamp,event.action,host.ip[0],host.os.name,host.type,user.name,Vendor.properties.AccountDisplayName,Vendor.properties.ISP])Detects authentication events using the device code flow as identified by Microsoft Defender for Identity, where a user enters a code on a separate device to complete sign‑in. While commonly used for legitimate scenarios, this method can be abused by attackers to perform phishing‑based authentication or bypass traditional sign‑in monitoring
device_code_sign_in.yml
T1550
Kundan Kumar
Detection
Identity
Identity
2026-05-08
2026-05-08
