alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Microsoft OAuth 2.0 Device Auth Activity M3 (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/common/oauth2/v2.0/authorize?client_id="; fast_pattern; content:"redirect_uri="; distance:0; http.host; content:"login.microsoftonline.com"; reference:url,learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code#device-authorization-request; classtype:misc-activity; sid:2066330; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_12_15, deployment Perimeter, deployment SSLDecrypt, performance_impact Significant, confidence High, signature_severity Informational, updated_at 2025_12_15; target:src_ip;)