El phishing que no te pide la contraseña, y por eso el MFA no lo detiene

account.important.vu
sayze.cl
zace0bwdgj.smoothwebexperiences.de

title: Autenticacion por Device Code Flow en Entra ID
id: 7c41f0ab-2d95-4e18-b6f3-1a08d5e97c24
status: experimental
description: |
  Detecta inicios de sesion que usan el flujo de codigo de dispositivo (RFC 8628).
  En la mayoria de los tenants corporativos este flujo no se usa nunca, asi que
  cualquier aparicion merece revision. La campana AIA26-00268 lo aprovecho para
  obtener tokens validos sin montar una pagina de login falsa: la victima se
  autentica en el portal real de Microsoft y entrega el codigo al atacante.
author: Vantis Chile SpA
date: 2026/09/02
references:
  - https://www.vantis.cl/noticias/device-code-phishing-campana-nacional-microsoft-365-chile
  - https://datatracker.ietf.org/doc/html/rfc8628
logsource:
  product: azure
  service: signinlogs
detection:
  device_code:
    properties.authenticationProtocol: deviceCode
  exitoso:
    properties.status.errorCode: 0
  condition: device_code and exitoso
fields:
  - properties.userPrincipalName
  - properties.appDisplayName
  - properties.ipAddress
  - properties.location.countryOrRegion
falsepositives:
  - Aprovisionamiento de equipos sin teclado, como salas Teams Rooms o senaletica digital
  - Herramientas de consola que lo usan a proposito, como "az login --use-device-code"
  - Onboarding masivo de dispositivos por parte del area de TI, acotado en el tiempo
level: high
tags:
  - attack.credential_access
  - attack.t1528
  - attack.initial_access
  - attack.t1566

// Inicios de sesion por Device Code Flow: en la mayoria de los tenants deberian ser cero
SigninLogs
| where TimeGenerated > ago(90d)
| where AuthenticationProtocol =~ "deviceCode"
| extend Pais = tostring(LocationDetails.countryOrRegion),
         Ciudad = tostring(LocationDetails.city)
| summarize Intentos = count(),
            Exitosos = countif(ResultType == 0),
            Apps = make_set(AppDisplayName, 10),
            Paises = make_set(Pais, 10),
            IPs = make_set(IPAddress, 10),
            Primero = min(TimeGenerated), Ultimo = max(TimeGenerated)
        by UserPrincipalName
| order by Exitosos desc

// Actividad posterior tipica: reglas de correo, lectura masiva por Graph, dispositivos nuevos
let ventana = 90d;
union isfuzzy=true
 (CloudAppEvents
    | where Timestamp > ago(ventana)
    | where ActionType in ("New-InboxRule","Set-InboxRule","UpdateInboxRules")
    | project Timestamp, Usuario = AccountDisplayName, Senal = "regla de correo creada",
              Detalle = tostring(RawEventData)),
 (AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(ventana)
    | where AppDisplayName has_any ("Microsoft Graph","Microsoft Authentication Broker")
    | where ResultType == 0
    | project Timestamp = TimeGenerated, Usuario = UserPrincipalName,
              Senal = "token usado contra Graph", Detalle = strcat(IPAddress, " / ", AppDisplayName)),
 (AuditLogs
    | where TimeGenerated > ago(ventana)
    | where OperationName has_any ("Add device","Add registered users","Consent to application")
    | project Timestamp = TimeGenerated,
              Usuario = tostring(InitiatedBy.user.userPrincipalName),
              Senal = OperationName, Detalle = tostring(TargetResources))
| order by Timestamp desc

// Los tres dominios publicados por la ANCI en AIA26-00268
let dominios = dynamic(["account.important.vu","sayze.cl","zace0bwdgj.smoothwebexperiences.de"]);
union isfuzzy=true
 (EmailUrlInfo | where Timestamp > ago(120d) | where Url has_any (dominios)
    | project Timestamp, Origen = "correo", Detalle = Url),
 (DeviceNetworkEvents | where Timestamp > ago(120d) | where RemoteUrl has_any (dominios)
    | project Timestamp, Origen = "navegacion", Detalle = RemoteUrl),
 (DnsEvents | where TimeGenerated > ago(120d) | where Name has_any (dominios)
    | project Timestamp = TimeGenerated, Origen = "dns", Detalle = Name)
| order by Timestamp desc

rule vantis_aia26_00268_device_code_dominios {

  meta:
    author = "Vantis Chile SpA"
    description = "Contacto con los tres dominios de la campana de Device Code phishing " \
                  "publicada por la ANCI en AIA26-00268 (Chile, agosto 2026)"
    reference = "https://www.vantis.cl/noticias/device-code-phishing-campana-nacional-microsoft-365-chile"
    severity = "HIGH"
    priority = "HIGH"
    rule_version = "1.0"
    yara_version = "YL2.0"

  events:
    (
      re.regex($e.network.dns.questions.name,
               `(^|\.)(account\.important\.vu|sayze\.cl|zace0bwdgj\.smoothwebexperiences\.de)$`)
      or
      re.regex($e.target.hostname,
               `(^|\.)(account\.important\.vu|sayze\.cl|zace0bwdgj\.smoothwebexperiences\.de)$`)
      or
      re.regex($e.target.url,
               `(account\.important\.vu|sayze\.cl|zace0bwdgj\.smoothwebexperiences\.de)`)
    )

  outcome:
    $usuario = $e.principal.user.userid
    $equipo = $e.principal.hostname
    $destino = $e.target.hostname

  condition:
    $e
}

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS fecha,
  QIDNAME(qid)                                  AS evento,
  LOGSOURCENAME(logsourceid)                    AS fuente,
  username                                      AS usuario,
  sourceip                                      AS origen,
  destinationip                                 AS destino,
  "URL"                                         AS url,
  "DNS Query Name"                              AS consulta_dns
FROM events
WHERE
      "URL" ILIKE '%account.important.vu%'
   OR "URL" ILIKE '%sayze.cl%'
   OR "URL" ILIKE '%zace0bwdgj.smoothwebexperiences.de%'
   OR "DNS Query Name" ILIKE '%account.important.vu%'
   OR "DNS Query Name" ILIKE '%sayze.cl%'
   OR "DNS Query Name" ILIKE '%zace0bwdgj.smoothwebexperiences.de%'
ORDER BY devicetime DESC
LAST 90 DAYS