Microsoft 365 OAuth Device Code Flow and Phishing
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Multi-Factor Authentication - T1556.006 Password Guessing - T1110.001 Password Spraying - T1110.003 Phishing - T1660 Phishing - T1566 Python - T1059.006 Server - T1583.004 Server - T1584.004 Tool - T1588.002
Show in Graph
Common Information
Type Value
UUID 2afd54c6-eddc-415f-9cf1-49f5e12ac02c
Fingerprint ae018f1a2e1b3bcd
Analysis status DONE
Considered CTI value 0
Text language
Published Aug. 17, 2021, noon
Added to db Nov. 6, 2023, 7:35 p.m.
Last updated Nov. 17, 2024, 10:40 p.m.
Headline UNKNOWN
Title Microsoft 365 OAuth Device Code Flow and Phishing
Detected Hints/Tags/Attributes 38/2/13
Source URLs
Redirection Url
Details Source https://www.optiv.com/insights/source-zero/blog/microsoft-365-oauth-device-code-flow-and-phishing
URL Provider
Details Provider Source level domain
Details optiv.com www.optiv.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 346 ✔ Optiv Blog https://www.optiv.com/resources/blog/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 61 
login.microsoftonline.com
Details Domain 5 
contacts.read
Details Domain 17 
mail.read
Details Domain 1 
notes.read
Details Domain 12 
user.read
Details Domain 369 
microsoft.com
Details Domain 1 
devicephish.py
Details Domain 72 
optiv.com
Details Email 65 
legal@optiv.com
Details File 1 
devicephish.py
Details Url 1 
https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode
Details Url 1 
https://microsoft.com/devicelogin
Details Url 3 
https://login.microsoftonline.com/organizations/oauth2/v2.0/token