---
title: Entra ID device code phishing token refresh
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID device code phishing token
  refresh
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device code phishing token refresh
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1528-steal-application-access-token](https://attack.mitre.org/techniques/T1528) 
## Goal{% #goal %}

Detects Entra ID token refresh activity following device code flow authentication that indicates ongoing access from an account compromise.

## Strategy{% #strategy %}

This rule monitors Entra ID non-interactive sign-in logs following device code flow authentication that indicates ongoing access from an account compromise. Two conditions are evaluated. The first triggers when `@properties.deviceDetail.displayName` matches non-standard default Windows hostname pattern, associated with known device code phishing services. The second triggers when the successful token refresh is observed from the `Microsoft Authentication Broker` or `Microsoft Office`, applications commonly abused by device code phishing services.

## Triage and response{% #triage-and-response %}

- Examine the device details in `@properties.deviceDetail.displayName` and `@properties.deviceDetail.deviceId` to determine whether the session originates from a known corporate endpoint.
- Identify the user account `{{@ocsf.actor.user.email_addr}}` associated with the token refresh and verify whether they recently completed a device code authentication prompt.
- Review the application and resource accessed using `@properties.appId` and `@properties.resourceId` to understand which cloud resources the refreshed token is being used to reach.
- Determine whether other token refresh events from the same `@properties.deviceDetail.deviceId` or `@ocsf.src_endpoint.ip` occurred across additional user accounts in the surrounding time window.
- Review earlier sign-in events for `{{@ocsf.actor.user.email_addr}}` where `@properties.authenticationProtocol` is `deviceCodeFlow` to reconstruct the initial compromise timeline.