[New Rule] Entra ID Atypical Sign-In Attempts via Device Code for Single User

[terrancedejesus]

Add another detection for Entra ID device code auth flows where a single session has different atypical travel or different user-agents.

Ref: https://www.wiz.io/blog/recent-oauth-attacks-detection-strategies