Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful Entra ID join device registrations where the device uses a non-standard default Windows hostname pattern.

Strategy

This rule monitors Entra ID audit logs when @properties.targetResources.displayName matches the default Windows hostname format DESKTOP- followed by six or eight alphanumeric characters. Attackers registering devices through device code phishing commonly use default hostnames rather than organization-managed naming conventions.

Triage and response

• Examine the registered device name in @properties.targetResources.displayName and determine whether it matches a known corporate asset naming standard.
• Identify the user account {{@ocsf.actor.user.email_addr}} that performed the registration and verify whether they recently completed a device code authentication prompt.
• Review recent non-interactive sign-in logs for {{@ocsf.actor.user.email_addr}} where @properties.originalTransferMethod is deviceCodeFlow to identify the source of the device code request.
• Check whether the device is marked as managed in Entra ID and whether conditional access policies should have blocked an unmanaged registration.
• Determine whether other devices with default DESKTOP- hostnames were registered by the same user or from the same source IP in the surrounding time window.