alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Microsoft OAuth 2.0 Device Auth Activity M2 (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:12; content:"/devicelogin"; fast_pattern; http.host; pcre:"/^(www\.microsoft\.com|aka\.ms)$/i"; reference:url,learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code#device-authorization-request; classtype:misc-activity; sid:2060050; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_02_12, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, updated_at 2025_02_12;)