Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects Entra ID Azure AD join device registration performed with a non-standard user agent for the registering user.

Strategy

This rule monitors Entra ID audit activity where @ocsf.activity_name is Register device. It excludes registrations where @http.useragent matches expected operating-system clients (Dsreg*, DeviceRegistrationClient, or Dalvik*).

Legitimate Azure AD join flows typically use these built-in registration clients; registrations from other user agents can reflect scripted or tool-driven enrollment used to establish a trusted device for persistence.

Triage & Response

• Contact {{@ocsf.actor.user.email_addr}} to confirm whether they intentionally joined a device to Entra ID during the alert timeframe.
• Review the @http.useragent value on the registration event and determine whether it matches a known corporate endpoint management tool or an unexpected client library, script, or browser.
• Examine the registered device details in Entra ID, including device name, ownership, and compliance state, and compare them to devices normally associated with {{@ocsf.actor.user.email_addr}}.
• Check {{@network.client.ip}}, geographic location, and authentication context around the registration for deviation from the user’s typical sign-in patterns.
• Review recent Entra ID audit and sign-in activity for {{@ocsf.actor.user.email_addr}} for other account manipulation, consent grants, or conditional access policy changes near the registration time.
• Identify whether other users registered devices from the same @http.useragent or {{@network.client.ip}} to assess broader unauthorized enrollment activity.