Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN

Detects Microsoft Entra ID sign-in activity where the Microsoft Authentication Broker requests the Device Registration Service from a source autonomous system number (ASN) associated with VPN, residential proxy, or hosting egress commonly observed in OAuth phishing and adversary-in-the-middle device registration flows. This pattern can indicate device join or primary refresh token acquisition staged from attacker-controlled infrastructure after a user completes authentication.

ATT&CK coverage

Initial Access

T1566Phishing80 detections cover this technique
- T1566.002Spearphishing Link 47 detections cover this technique

Persistence

T1098Account ManipulationAlso under Privilege Escalation.230 detections cover this technique
- T1098.005Device Registration 26 detections cover this technique

Lateral Movement

T1550Use Alternate Authentication Material64 detections cover this technique
- T1550.001Application Access Token 43 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.