---
title: Entra ID device registration using non standard Windows hostname
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID device registration using non
  standard Windows hostname
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device registration using non standard Windows hostname
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects successful Entra ID join device registrations where the device uses a non-standard default Windows hostname pattern.

## Strategy{% #strategy %}

This rule monitors Entra ID audit logs when `@properties.targetResources.displayName` matches the default Windows hostname format `DESKTOP-` followed by six or eight alphanumeric characters. Attackers registering devices through device code phishing commonly use default hostnames rather than organization-managed naming conventions.

## Triage and response{% #triage-and-response %}

- Examine the registered device name in `@properties.targetResources.displayName` and determine whether it matches a known corporate asset naming standard.
- Identify the user account `{{@ocsf.actor.user.email_addr}}` that performed the registration and verify whether they recently completed a device code authentication prompt.
- Review recent non-interactive sign-in logs for `{{@ocsf.actor.user.email_addr}}` where `@properties.originalTransferMethod` is `deviceCodeFlow` to identify the source of the device code request.
- Check whether the device is marked as managed in Entra ID and whether conditional access policies should have blocked an unmanaged registration.
- Determine whether other devices with default `DESKTOP-` hostnames were registered by the same user or from the same source IP in the surrounding time window.