---
title: >-
  Entra ID device registration using a user agent associated with device code
  phishing service
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID device registration using a
  user agent associated with device code phishing service
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device registration using a user agent associated with device code phishing service
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects successful Entra ID join device registrations using a `Dsreg` user agent associated with device code phishing-as-a-service tooling.

## Strategy{% #strategy %}

This rule monitors Entra ID audit logs when `@ocsf.http_request.user_agent` matches known `Dsreg` strings used by automated device code phishing services, specifically `Dsreg/10.0 (Windows 10.0.19041.928)` and `Dsreg/10.0 (Windows 10.0.19045.2006)`. These user agent values are hardcoded fingerprints of phishing-as-a-service platforms that register attacker-controlled devices into a victim tenant after a user completes a device code prompt.

## Triage and response{% #triage-and-response %}

- Examine the registered device record in `@properties.targetResources.displayName` and determine whether the device belongs to a known user endpoint in the organization.
- Identify the user account `{{@ocsf.actor.user.email_addr}}` that initiated the registration and verify whether they recently reported a suspicious sign-in prompt or device code request.
- Review recent non-interactive sign-in logs for `{{@ocsf.actor.user.email_addr}}` where `@properties.originalTransferMethod` is `deviceCodeFlow` to reconstruct the authentication sequence.
- Check whether the registered device appears in other Entra ID sign-in or audit events from unusual source locations or IP addresses.
- Determine whether additional devices were registered by the same user or with the same `@ocsf.http_request.user_agent` in the surrounding time window.