Threat Hunting N0Va Phishing Kits with Microsoft Sentinel

Microsoft Sentinel's, focus on the behaviors N0va relies on: Device Code Authentication, token abuse, anomalous device registration, and suspicious cloud sign-ins. N0va is reported to use Microsoft Device Code phishing to obtain tokens and then leverage device registration and PRT-based SSO access.

1. Device Code Authentication Detection

SigninLogs
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          Location,
          AppDisplayName,
          ConditionalAccessStatus
| order by TimeGenerated desc

Alert logic

• Any device code authentication for users who don't normally use Teams Rooms, IoT devices, or CLI tools.
• Multiple users authenticating through device code within a short period.

---

2. New Device Registration After Device Code Login

let DeviceCodeUsers =
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| summarize LastDeviceCode=max(TimeGenerated) by UserPrincipalName;
AuditLogs
| where OperationName contains "Register"
| where TargetResources has "Device"
| extend UserPrincipalName=tostring(InitiatedBy.user.userPrincipalName)
| join kind=inner DeviceCodeUsers on UserPrincipalName
| where TimeGenerated between (LastDeviceCode .. LastDeviceCode + 24h)

Why N0va reportedly uses device-registration mechanisms after token acquisition.

---

3. Impossible Travel Following Device Code Auth

let DeviceCodeSignin =
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| project UserPrincipalName, TimeGenerated;
SigninLogs
| join kind=inner DeviceCodeSignin on UserPrincipalName
| where TimeGenerated1 > TimeGenerated
| project UserPrincipalName,
          DeviceCodeTime=TimeGenerated,
          SubsequentLogin=TimeGenerated1,
          IPAddress,
          Location

Enhance with Sentinel UEBA or Impossible Travel analytics.

---

4. High-Risk Azure AD Sign-ins

SigninLogs
| where RiskLevelAggregated in ("high","medium")
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          RiskLevelAggregated,
          RiskDetail

---

5. Suspicious OAuth Token Activity

AuditLogs
| where OperationName in (
    "Add delegated permission grant",
    "Add app role assignment",
    "Consent to application"
)
| project TimeGenerated,
          OperationName,
          InitiatedBy,
          TargetResources

Token-focused phishing campaigns often attempt persistence through OAuth permissions.

---

6. Device Code Sign-ins from Untrusted Countries

SigninLogs
| where AuthenticationProtocol == "deviceCode"
| where Location !in ("United States")
| summarize Count=count()
    by UserPrincipalName, Location, IPAddress
| order by Count desc

Replace locations with your approved geographies.

---

7. Multiple Device Code Attempts from Same IP

SigninLogs
| where AuthenticationProtocol == "deviceCode"
| summarize Users=dcount(UserPrincipalName),
            Accounts=make_set(UserPrincipalName)
            by IPAddress, bin(TimeGenerated, 1h)
| where Users > 3

Potential indicator One phishing operator authenticating multiple victims.

---

8. Device Code Sign-in Followed by Exchange Access

let DeviceCodeAuths =
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| project UserPrincipalName, DeviceCodeTime=TimeGenerated;
SigninLogs
| where ResourceDisplayName contains "Office 365"
   or ResourceDisplayName contains "Exchange"
| join kind=inner DeviceCodeAuths on UserPrincipalName
| where TimeGenerated between (DeviceCodeTime .. DeviceCodeTime + 2h)

Useful for identifying token use immediately after compromise.

---

Sentinel Analytic Rule Recommendation

Set a High Severity alert when:

SigninLogs
| where AuthenticationProtocol == "deviceCode"
| summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m)
| where count_ > 2

Map to:

• MITRE ATT&CK T1566.002 (Phishing)
• T1078 (Valid Accounts)
• T1528 (Steal Application Access Token)
• T1098 (Account Manipulation)

Additional Entra ID Logging to Enable

• Sign-in Logs
• Audit Logs
• Risky Sign-ins
• Risk Detections
• Microsoft Defender for Cloud Apps
• UEBA in Sentinel

These detections are particularly effective against N0va's reported use of Device Code phishing, token theft, and device registration activity.