// Device Code Auth von unbekannten Quell-IPs — potenzielle AI-Phishing-Kampagne
SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol == "deviceCode"
| where ResultType == 0
| summarize FirstSeen = min(TimeGenerated), Count = count()
by UserPrincipalName, IPAddress, AppDisplayName,
tostring(LocationDetails.countryOrRegion)
| join kind=leftouter (
SigninLogs
| where TimeGenerated between (ago(30d) .. ago(24h))
| where AuthenticationProtocol == "deviceCode"
| summarize HistoricalCount = count() by UserPrincipalName, IPAddress
) on UserPrincipalName, IPAddress
| where isempty(HistoricalCount)
| project FirstSeen, UserPrincipalName, IPAddress,
AppDisplayName, CountryOrRegion = tostring(LocationDetails.countryOrRegion)
| order by FirstSeen desc