Sunturai
Back to results
InformationalSplunk security contentJake Enea +2

Azure AD Suspicious Device Registration

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0…

Description

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)". This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments. Device registration can support persistence or provide a device identity that can be used to access internal resources. If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.

Detection logic

Detection requirements

Platform
Identity ProviderPREWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
azure_active_directory

Known benign triggers

  • Users may register devices with names that match the suspicious patterns. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice