Lab: Entra Device Code Phishing Detection

Hunt device-code phishing across Sentinel and Defender XDR with safe replay data, telemetry checks, KQL detections, and a triage checklist.

Overview

This lab provides two disabled-by-default Microsoft Sentinel analytics rules, three Defender XDR hunts, a neutral synthetic replay, and an optional no-secret public client for lab-owned sign-in telemetry. It covers the 50199-to-success pattern, immutable app-ID exceptions, post-token mailbox behavior, and device registration after token issuance.

Start Here

  1. Read the companion article for the attack model and tuning guidance.
  2. Open the canonical GitHub repository.
  3. Treat the README and tracked KQL files as the operational source of truth. Follow their exact preflight, deployment, replay or telemetry, verification, and cleanup sequence.

The included replay data is the preferred starting point. Do not conduct phishing against real users, and do not use the optional app outside a dedicated lab identity.

Reviewed Implementation Notes

  • scripts/manage-sentinel-rules.ps1 is the only supported rule lifecycle path. It preflights two fixed workspace-scoped rule IDs and both display names, refuses foreign collisions, and requires the exact local provenance manifest plus ownership suffix before updating or removing existing rules.
  • Both scheduled rules deploy disabled. Explicit enablement requires -EnableRules -Execute -Confirm after you verify SigninLogs, run the tracked KQL manually, and tune only immutable app-ID exceptions.
  • The Sentinel Bicep template loads the tracked KQL files directly, so the deployable rules cannot silently drift from the reviewed query sources.
  • The telemetry checker requires the exact lab client ID and user UPN; RunId is optional and never replaces that scope. Disabled rules do not create incidents.
  • The optional Graph Bicep app requires a fresh GUID-suffixed uniqueName. Cleanup reads the exact tenant, client, application-object, service-principal, and uniqueName values, validates every ownership tag before deletion, never searches by display name or UPN, and never deletes users.
  • The July 25 review was offline: both Bicep templates compiled, every PowerShell entry point parsed, mocked collision and ownership failures stopped before mutation, and the canonical and bundled lab copies matched byte for byte. It did not create or delete a tenant object, approve a device code, or run a live cloud query.