Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful Entra ID join device registrations using a Dsreg user agent associated with device code phishing-as-a-service tooling.

Strategy

This rule monitors Entra ID audit logs when @ocsf.http_request.user_agent matches known Dsreg strings used by automated device code phishing services, specifically Dsreg/10.0 (Windows 10.0.19041.928) and Dsreg/10.0 (Windows 10.0.19045.2006). These user agent values are hardcoded fingerprints of phishing-as-a-service platforms that register attacker-controlled devices into a victim tenant after a user completes a device code prompt.

Triage and response

• Examine the registered device record in @properties.targetResources.displayName and determine whether the device belongs to a known user endpoint in the organization.
• Identify the user account {{@ocsf.actor.user.email_addr}} that initiated the registration and verify whether they recently reported a suspicious sign-in prompt or device code request.
• Review recent non-interactive sign-in logs for {{@ocsf.actor.user.email_addr}} where @properties.originalTransferMethod is deviceCodeFlow to reconstruct the authentication sequence.
• Check whether the registered device appears in other Entra ID sign-in or audit events from unusual source locations or IP addresses.
• Determine whether additional devices were registered by the same user or with the same @ocsf.http_request.user_agent in the surrounding time window.