Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects a burst of successful Entra ID join device registrations by a single user within a short time window.

Strategy

This rule monitors Entra ID audit logs where @ocsf.metadata.event_code is Register device, @ocsf.status is Success, and @properties.additionalDetails.value is Azure AD join. The detection triggers when a single @ocsf.actor.user.email_addr registers three or more devices within a fifteen-minute evaluation window. Bulk device registration from one account is atypical for legitimate endpoint onboarding and aligns with device code phishing campaigns where an attacker registers multiple devices after compromising a user’s consent to a device code prompt.

Triage and response

• Identify the user account {{@ocsf.actor.user.email_addr}} responsible for the registrations and verify whether a bulk device enrollment or migration project was scheduled.
• Review the list of registered device names in @properties.targetResources.displayName and determine whether they belong to known corporate assets or share suspicious naming patterns.
• Examine recent non-interactive sign-in logs for {{@ocsf.actor.user.email_addr}} where @properties.originalTransferMethod is deviceCodeFlow to confirm whether device code authentication preceded the registrations.
• Check whether the registered devices are unmanaged and whether conditional access policies should have restricted their enrollment.
• Determine whether the same user reported a suspicious sign-in prompt or MFA fatigue attempt prior to the registration burst.