From a4d855cbbe1fd34ef1b5c09fb5345e90ba55c21a Mon Sep 17 00:00:00 2001
From: markusza <25240898+markusza@users.noreply.github.com>
Date: Tue, 29 Apr 2025 14:43:01 +1200
Subject: [PATCH] Adde detection Readme.md

---
 Readme.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index e449a60..493cbf0 100644
--- a/Readme.md
+++ b/Readme.md
@@ -111,5 +111,12 @@ docker build . -t device-code-phishing
 docker run -p 8080:8080 device-code-phishing
 ```
 
+## Detection
+The following three fields and their values identify DeviceCodePhishing events:
+
+* originalTransferMethod: `deviceCodeFlow`
+* resourceDisplayName: `Microsoft Graph`
+* appDisplayName: `Microsoft Authentication Broker`
+
 ## Disclaimer
-Provided as educational content only!
\ No newline at end of file
+Provided as educational content only!