Detect OAuth Abuse in Entra ID: Device-Code Phishing, ROPC and Persistence
Summary
Wiz describes how attackers abuse device-code phishing and legacy ROPC flows in Azure environments, including device registration for persistence, and provides Entra ID log patterns and KQL queries to detect the activity.
Key points
- Device-code phishing can relay a victim’s MFA-authenticated token to an attacker; sign-in events with a shared session ID but inconsistent locations or user agents can help reveal it.
- Wiz telemetry indicates fewer than 50% of customers enforce Conditional Access policies blocking device-code authentication; 0.3% of device-code attempts were stopped by a Block rule.
- Wiz reports fewer than 45% of customers enforce Conditional Access policies requiring MFA for ROPC; 0.2% of ROPC attempts were stopped by a Block rule.
- ROPC exchanges a username and password directly for a token. Wiz observed attacks targeting Azure AD PowerShell and attempting access through Azure Resource Manager or Microsoft Graph; many attempts failed, but some token exchanges succeeded.
- The article describes how a token for the Microsoft Authentication Broker and Intune Enrollment can enable device registration; a registered device can provide persistence, and Windows Hello for Business setup may satisfy stronger authentication requirements.
- The article provides KQL queries to correlate suspicious sign-ins with device registration and Windows Hello for Business enrollment, and recommends restricting ROPC and using Conditional Access.
Article Details
- Defense Focus
- Detect device-code phishing, ROPC abuse and brute-force attempts, suspicious device registration, and Windows Hello for Business provisioning that may establish persistent access in Entra ID.
- Detection Methods
- Correlate interactive and non-interactive sign-in events by session ID; flag deviceCodeFlow sessions with inconsistent user agents or countries.
- Monitor authenticationProtocol for ROPC and investigate anomalous locations, user agents, and application/resource pairings.
- Identify bursts of failed ROPC password attempts using error code 50126, then correlate them with successful ROPC sign-ins.
- Correlate successful ROPC sign-ins with device-registration audit events within two days.
- Correlate suspicious device-code sign-ins with Windows Hello for Business credential registration within one day, especially when the registration IP differs from the sign-in IP.
- Review token properties, authentication context, application/resource pairings, and device-enrollment activity for deviations from normal tenant behavior.
- Data Sources
- Entra ID AADNonInteractiveUserSignInLogs
- Entra ID SigninLogs
- Entra ID AuditLogs
- Sign-in fields including originalTransferMethod, authenticationProtocol, clientAppUsed, status.errorCode, sessionId, userAgent, ipAddress, location.countryOrRegion, appId, and resourceId
- Device enrollment and Windows Hello for Business credential registration audit events
- Rule Types
- KQL correlation and anomaly-detection queries
- Platforms
- Wiz Defend
- Defensive Actions
- Restrict ROPC and require MFA through Conditional Access.
- Use Conditional Access to allow access only from compliant devices and block device-code authentication where appropriate.
- Investigate suspicious authentication and enrollment activity before a trusted device or stronger passwordless authentication method is established.
- Reset affected credentials, block malicious apps, and stop suspicious device enrollment.
MITRE ATT&CK
T1098.005 · Device RegistrationAfter obtaining a token, attackers may register a device to establish persistence and obtain a Primary Refresh Token.T1110.001 · Password GuessingThe article describes ROPC being used for brute-force password attempts, including bursts of failed authentications.T1110.003 · Password SprayingThe article describes ROPC being used for credential-stuffing attempts against Azure authentication.T1566.002 · Spearphishing LinkIn device-code phishing, attackers lure victims into entering an attacker-generated device code through a phishing message.
People
Threat Actors
Vendors
Products
Azurepost we’ll expose how adversaries abuse OAuth flows to gain initial access and maintain persistence in Azure environments, and how defenders can uncover these behaviors by analyzing sign-in activity. Drawing fromAzure Active Directory PowerShelltargeting customers across various environments. These campaigns frequently leveraged Azure Active Directory PowerShell applications and attempted access through Azure Resource Manager or Microsoft Graph. TheAzure Resource Managerfrequently leveraged Azure Active Directory PowerShell applications and attempted access through Azure Resource Manager or Microsoft Graph. The activity commonly used generic user agents such as Mozilla/5.0, alongsideEntra IDEntra ID sign-in logs capture this relationship too, mirroring key fields from the JWT.Intune Enrollmentof a device: an access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.Microsoft Authentication Brokerof these combinations enables the registration of a device: an access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate theMicrosoft Graphto the Users tab in Entra, the application (Azure Portal) requests an access token for the Microsoft Graph API, since that’s the backend service providing user data (graph.microsoft.com/users).Windows Hello for BusinessConditional Access controls. To deal with this, attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra
Tools
Entra ScopesProjects like Entra Scopes by Dirk-jan Mollema and Fabian Bader show which apps and scopes can be chained for extended access. For example, combining Azure AD PowerShell with Microsoft Graph can yield significantroadtxReal-world tooling such as RoadTx automates the full sequence: generating a device code, phishing a victim to complete login, exchanging tokens for enrollment permissions, registering the device, and finally