For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-p01.md. A documentation index is available at /llms.txt.

Entra ID device registration using non standard Windows hostname

azure

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

Goal

Detects successful Entra ID join device registrations where the device uses a non-standard default Windows hostname pattern.

Strategy

This rule monitors Entra ID audit logs when @properties.targetResources.displayName matches the default Windows hostname format DESKTOP- followed by six or eight alphanumeric characters. Attackers registering devices through device code phishing commonly use default hostnames rather than organization-managed naming conventions.

Triage and response

  • Examine the registered device name in @properties.targetResources.displayName and determine whether it matches a known corporate asset naming standard.
  • Identify the user account {{@ocsf.actor.user.email_addr}} that performed the registration and verify whether they recently completed a device code authentication prompt.
  • Review recent non-interactive sign-in logs for {{@ocsf.actor.user.email_addr}} where @properties.originalTransferMethod is deviceCodeFlow to identify the source of the device code request.
  • Check whether the device is marked as managed in Entra ID and whether conditional access policies should have blocked an unmanaged registration.
  • Determine whether other devices with default DESKTOP- hostnames were registered by the same user or from the same source IP in the surrounding time window.