Microsoft device code phishing

type.inbound

// Not from MS as the device code will be generated and sent by the attacker
and sender.email.domain.root_domain not in~ ("microsoft.com", "microsoftonline.com")

// Link to the device code MS pages
and any(body.links,
        (
          .href_url.url == "https://microsoft.com/devicelogin"
          or .href_url.url == "https://login.microsoftonline.com/common/oauth2/deviceauth"
          or .href_url.url == "https://aka.ms/devicelogin"
        )
)

// Body text references device codes
and (
  strings.icontains(body.html.display_text, "device code")
  or 
  // A nine character string containing a combination of letters and characters
  regex.icontains(body.html.display_text, '[\W]([A-Z0-9]{9})[\W]')
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)