From ccb75b950da1969e29e1eaaccbfdf6c48d14b37d Mon Sep 17 00:00:00 2001
From: Terrance DeJesus <terrance.dejesus@elastic.co>
Date: Tue, 30 Jun 2026 09:18:48 -0400
Subject: [PATCH] [Rule Tuning] Entra ID OAuth Device Code Phishing via AiTM

---
 ...ccess_entra_id_oauth_device_code_phishing_tycoon_aitm.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml b/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
index 342b9c5c5f1..971df3504b5 100644
--- a/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
+++ b/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
@@ -2,7 +2,7 @@
 creation_date = "2026/05/15"
 integration = ["azure"]
 maturity = "production"
-updated_date = "2026/05/15"
+updated_date = "2026/06/20"
 
 [rule]
 author = ["Elastic"]
@@ -76,7 +76,7 @@ azure.signinlogs.properties.authentication_protocol:deviceCode and
 azure.signinlogs.properties.resource_id:(
     "00000002-0000-0ff1-ce00-000000000000" or
     "00000003-0000-0ff1-ce00-000000000000" or
-    "00000005-0000-0ff1-ce00-000000000000"
+    "00000003-0000-0000-c000-000000000000"
 ) and azure.signinlogs.properties.is_interactive:true
 '''