T1098.005

Device Registration

Adversaries may register a device to an adversary-controlled account to establish persistence or escalate privileges. Devices may be registered in an MFA system (Duo, Okta) to bypass multi-factor authentication requirements, or registered in a device management system (Entra ID, Intune) to access sensitive data while bypassing conditional access policies. APT29 has enrolled attacker-controlled devices into compromised Azure AD tenants. Tools like AADInternals can automate device registration to Entra ID. Adversaries may also exploit self-enrollment workflows that require only a username and password for dormant or first-device scenarios.

Microsoft Sentinel / Defender

kusto

// T1098.005 - Device Registration Detection
// Detects suspicious device registrations in Entra ID / Azure AD
let SuspiciousDeviceRegistration = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in (
    "Add device",
    "Register device",
    "Add registered owner to device",
    "Add registered users to device",
    "Update device",
    "Enroll device"
  )
| where Result =~ "success"
| extend
    InitiatedByUPN = tostring(InitiatedBy.user.userPrincipalName),
    InitiatedByIP = tostring(InitiatedBy.user.ipAddress),
    InitiatedByAppId = tostring(InitiatedBy.app.appId),
    InitiatedByAppName = tostring(InitiatedBy.app.displayName),
    DeviceDisplayName = tostring(TargetResources[0].displayName),
    DeviceId = tostring(TargetResources[0].id),
    ModifiedProps = TargetResources[0].modifiedProperties
| extend DeviceOS = tostring(parse_json(tostring(ModifiedProps))[0].newValue)
| project
    TimeGenerated,
    OperationName,
    InitiatedByUPN,
    InitiatedByIP,
    InitiatedByAppId,
    InitiatedByAppName,
    DeviceDisplayName,
    DeviceId,
    Result,
    Category,
    CorrelationId;
let RecentSignins = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| project
    SigninTime = TimeGenerated,
    SigninUPN = UserPrincipalName,
    SigninIP = IPAddress,
    SigninAppDisplayName = AppDisplayName,
    SigninCountry = LocationDetails.countryOrRegion,
    SigninRiskLevel = RiskLevelDuringSignIn,
    SigninRiskState = RiskState,
    IsInteractive;
SuspiciousDeviceRegistration
| join kind=leftouter (
    RecentSignins
    | where SigninRiskLevel in ("high", "medium") or SigninRiskState in ("atRisk", "confirmedCompromised")
  ) on $left.InitiatedByUPN == $right.SigninUPN
| union (
    // Also catch bulk/rapid device registrations from same user or IP
    SuspiciousDeviceRegistration
    | summarize
        DeviceCount = count(),
        DeviceNames = make_set(DeviceDisplayName),
        OperationNames = make_set(OperationName),
        FirstSeen = min(TimeGenerated),
        LastSeen = max(TimeGenerated)
      by InitiatedByUPN, InitiatedByIP, bin(TimeGenerated, 1h)
    | where DeviceCount >= 3
    | extend AlertReason = strcat("Bulk device registration: ", tostring(DeviceCount), " devices in 1 hour")
  )
| extend SuspiciousIndicators = dynamic([])
| extend SuspiciousIndicators = iff(isnotempty(SigninRiskLevel) and SigninRiskLevel in ("high","medium"), array_concat(SuspiciousIndicators, dynamic(["risky-signin"])), SuspiciousIndicators)
| extend SuspiciousIndicators = iff(isnotempty(InitiatedByAppId) and InitiatedByAppName !in ("Microsoft Intune", "Microsoft Azure Active Directory Connect", "Microsoft Intune Enrollment", "Azure Active Directory"), array_concat(SuspiciousIndicators, dynamic(["unexpected-app"])), SuspiciousIndicators)
| sort by TimeGenerated desc

high severity medium confidence

Data Sources

Azure AD Audit Logs Azure AD Sign-in Logs Identity: User Account

Required Tables

AuditLogs SigninLogs

False Positives

IT administrators bulk-enrolling corporate devices during device refresh cycles or new employee onboarding
Automated device enrollment workflows via Microsoft Intune Autopilot or SCCM co-management
Users registering personal devices under a BYOD policy, especially after password resets
Microsoft Entra joined virtual machines provisioned by DevOps pipelines or cloud infrastructure teams

Splunk

spl

index=azure_audit sourcetype="azure:audit"
  (operationName="Add device" OR operationName="Register device" OR operationName="Add registered owner to device" OR operationName="Add registered users to device" OR operationName="Update device" OR operationName="Enroll device")
  result="success"
| eval initiatedByUPN=coalesce('initiatedBy.user.userPrincipalName', "unknown")
| eval initiatedByIP=coalesce('initiatedBy.user.ipAddress', "unknown")
| eval initiatedByApp=coalesce('initiatedBy.app.displayName', "unknown")
| eval deviceName=coalesce('targetResources{}.displayName', "unknown")
| eval deviceId=coalesce('targetResources{}.id', "unknown")
| eval isKnownEnrollmentApp=if(initiatedByApp IN ("Microsoft Intune", "Microsoft Azure Active Directory Connect", "Microsoft Intune Enrollment", "Azure Active Directory", "Microsoft Authentication Broker"), 1, 0)
| eval suspicionScore=0
| eval suspicionScore=suspicionScore + if(isKnownEnrollmentApp=0, 2, 0)
| eval suspicionScore=suspicionScore + if(match(initiatedByIP, "^(tor|vpn|proxy)"), 1, 0)
| stats
    count as registrationCount,
    values(deviceName) as deviceNames,
    values(operationName) as operations,
    values(initiatedByIP) as sourceIPs,
    values(initiatedByApp) as apps,
    sum(suspicionScore) as totalSuspicionScore,
    earliest(_time) as firstRegistration,
    latest(_time) as lastRegistration
  by initiatedByUPN
| eval bulkRegistration=if(registrationCount >= 3, 1, 0)
| eval totalSuspicionScore=totalSuspicionScore + if(bulkRegistration=1, 2, 0)
| where totalSuspicionScore > 0 OR bulkRegistration=1
| eval alertReason=case(
    bulkRegistration=1 AND totalSuspicionScore > 2, "Bulk registration by unexpected app",
    bulkRegistration=1, "Bulk device registration (3+ devices)",
    totalSuspicionScore > 2, "Device registered by unexpected application",
    true(), "Suspicious device registration"
  )
| table firstRegistration, lastRegistration, initiatedByUPN, sourceIPs, apps, deviceNames, registrationCount, totalSuspicionScore, alertReason
| sort - totalSuspicionScore

high severity medium confidence

Data Sources

Azure AD Audit Logs Identity: User Account

Required Sourcetypes

azure:audit

False Positives

IT administrators bulk-enrolling corporate devices during device refresh cycles or new employee onboarding
Automated device enrollment workflows via Microsoft Intune Autopilot or SCCM co-management
Users registering personal devices under a BYOD policy, especially after password resets
Third-party MDM solutions that register devices using their own application identity rather than standard Microsoft apps

Elastic Security (EQL)

eql

// T1098.005 — Bulk Device Registration (primary signal)
// Fires when the same user registers 3+ devices within 1 hour
sequence by azure.auditlogs.initiated_by.user.user_principal_name with maxspan=1h
  [any where
    event.dataset == "azure.auditlogs" and
    azure.auditlogs.operation_name in (
      "Add device",
      "Register device",
      "Add registered owner to device",
      "Add registered users to device",
      "Update device",
      "Enroll device"
    ) and
    event.outcome == "success"
  ] with runs=3

// ── Secondary (run as a separate saved query) ──────────────────────────────
// Fires on ANY single device registration initiated by an unexpected app
// any where
//   event.dataset == "azure.auditlogs" and
//   azure.auditlogs.operation_name in (
//     "Add device", "Register device", "Add registered owner to device",
//     "Add registered users to device", "Update device", "Enroll device"
//   ) and
//   event.outcome == "success" and
//   not azure.auditlogs.initiated_by.app.display_name in (
//     "Microsoft Intune",
//     "Microsoft Azure Active Directory Connect",
//     "Microsoft Intune Enrollment",
//     "Azure Active Directory",
//     "Microsoft Authentication Broker"
//   )

high severity medium confidence

Data Sources

Azure Active Directory Audit Logs ingested via Elastic Azure integration (logs-azure.auditlogs-*)

Required Tables

logs-azure.auditlogs-*

False Positives

IT administrators performing bulk device enrollment during corporate onboarding or hardware refresh campaigns using approved service accounts
Automated MDM provisioning pipelines (Intune Autopilot, JAMF) that trigger multiple sequential registration audit events mapped to a single service identity
Azure AD hybrid join initial synchronisation where Azure AD Connect registers all existing domain-joined machines in a single pass
Employees participating in a sanctioned BYOD rollout who self-enroll several personal devices within a short window

Sumo Logic CSE

sql

_sourceCategory=azure/audit OR _sourceCategory=azure/aad/audit
| json field=_raw "operationName"                            as operation_name nodrop
| json field=_raw "result"                                    as result nodrop
| json field=_raw "initiatedBy.user.userPrincipalName"        as initiated_by_upn nodrop
| json field=_raw "initiatedBy.user.ipAddress"                as source_ip nodrop
| json field=_raw "initiatedBy.app.displayName"               as app_name nodrop
| json field=_raw "targetResources[0].displayName"            as device_name nodrop
| json field=_raw "targetResources[0].id"                     as device_id nodrop
| where operation_name in (
    "Add device",
    "Register device",
    "Add registered owner to device",
    "Add registered users to device",
    "Update device",
    "Enroll device"
  )
| where result = "success"
| eval is_known_app = if (
    app_name in (
      "Microsoft Intune",
      "Microsoft Azure Active Directory Connect",
      "Microsoft Intune Enrollment",
      "Azure Active Directory",
      "Microsoft Authentication Broker"
    ), 1, 0
  )
| eval base_score = if (is_known_app = 0, 2, 0)
| timeslice 1h
| count as registration_count,
  values(device_name) as device_names,
  values(source_ip)   as source_ips,
  last(app_name)      as initiating_app,
  last(base_score)    as base_score
  by initiated_by_upn, _timeslice
| eval bulk_flag   = if (registration_count >= 3, 1, 0)
| eval total_score = base_score + if (bulk_flag = 1, 2, 0)
| where total_score > 0 or bulk_flag = 1
| eval alert_reason = if (
    bulk_flag = 1 and total_score > 2, "Bulk registration by unexpected app",
    if (bulk_flag = 1, "Bulk device registration (3+ in 1 hour)",
      if (total_score > 0, "Registration by unexpected application",
        "Suspicious device registration"
      )
    )
  )
| fields _timeslice, initiated_by_upn, source_ips, initiating_app, device_names, registration_count, total_score, alert_reason
| sort by total_score desc

high severity medium confidence

Data Sources

Azure Active Directory Audit Logs collected via Sumo Logic Azure source (HTTP Source or Blob Storage source)

Required Tables

_sourceCategory=azure/audit

False Positives

Bulk MDM onboarding events triggered when IT deploys a new device fleet and enrolment completes for multiple machines in the same hour
Third-party EMM solutions (Jamf Pro, VMware Workspace ONE, Ivanti) that appear as unexpected initiating apps relative to the Microsoft-centric allowlist
Partner tenants with B2B delegated admin rights performing device enrollment in a customer Azure AD environment
BYOD self-enrollment campaigns where employees register multiple personal devices (phone, tablet, laptop) within a single session

Google Chronicle / SecOps

yaral

// Rule 1 — Single registration by unexpected application
rule t1098_005_device_registration_unexpected_app {
  meta:
    author        = "Argus Detection Engineering"
    description   = "Detects Azure AD / Entra ID device registration initiated by an application outside the known MDM allowlist — consistent with adversary-controlled enrollment via AADInternals or similar tooling (T1098.005)"
    mitre_tactic  = "Persistence, Privilege Escalation"
    mitre_technique = "T1098.005"
    severity      = "HIGH"
    priority      = "HIGH"
    reference     = "https://attack.mitre.org/techniques/T1098/005/"

  events:
    $e.metadata.vendor_name      = "Microsoft"
    $e.metadata.product_name     = "Azure Active Directory"
    $e.metadata.event_status     = "SUCCESS"
    (
      $e.metadata.product_event_type = "Add device" or
      $e.metadata.product_event_type = "Register device" or
      $e.metadata.product_event_type = "Add registered owner to device" or
      $e.metadata.product_event_type = "Add registered users to device" or
      $e.metadata.product_event_type = "Update device" or
      $e.metadata.product_event_type = "Enroll device"
    )
    not $e.principal.application = /(?i)microsoft intune|intune enrollment|azure active directory connect|microsoft authentication broker|^azure active directory$/
    $e.principal.user.email_addresses[0] != ""
    $user = $e.principal.user.email_addresses[0]

  condition:
    $e
}


// Rule 2 — Bulk device registration (3+ devices from same user within 1 hour)
rule t1098_005_bulk_device_registration {
  meta:
    author        = "Argus Detection Engineering"
    description   = "Detects bulk Entra ID device enrollment — 3 or more successful device registrations from the same user within 1 hour — consistent with AADInternals Register-AADIntJoinedDevice automation and APT29 lateral-movement tradecraft (T1098.005)"
    mitre_tactic  = "Persistence, Privilege Escalation"
    mitre_technique = "T1098.005"
    severity      = "HIGH"
    priority      = "HIGH"
    reference     = "https://attack.mitre.org/techniques/T1098/005/"

  events:
    $e.metadata.vendor_name  = "Microsoft"
    $e.metadata.product_name = "Azure Active Directory"
    $e.metadata.event_status = "SUCCESS"
    (
      $e.metadata.product_event_type = "Add device" or
      $e.metadata.product_event_type = "Register device" or
      $e.metadata.product_event_type = "Enroll device"
    )
    $e.principal.user.email_addresses[0] != ""
    $user = $e.principal.user.email_addresses[0]

  match:
    $user over 1h

  condition:
    #e >= 3
}

high severity medium confidence

Data Sources

Google Chronicle UDM — Azure Active Directory audit log feed (native Chronicle Azure AD ingestion or forwarder-based ingestion)

Required Tables

UDM events with metadata.product_name = "Azure Active Directory"

False Positives

IT provisioning teams performing mass device enrollment during a hardware refresh using tooling that does not match the Microsoft MDM application name allowlist
Azure AD B2B guest device registrations during cross-tenant collaboration scenarios where the initiating app identity differs from tenant-native Intune
First-time Azure AD hybrid join synchronisation where Azure AD Connect registers all domain-joined machines in a single scheduled sync pass
Third-party identity governance solutions (SailPoint, Saviynt) performing device lifecycle operations as part of a joiner/mover/leaver workflow

CrowdStrike LogScale (CQL)

cql

// T1098.005 — Device Registration Detection (CrowdStrike Falcon LogScale / CQL)
// Assumes Azure AD audit logs ingested via Falcon LogScale Azure integration
// with ECS-compatible field mapping
event.dataset = "azure.auditlogs"
| azure.auditlogs.operation_name = /^(Add device|Register device|Add registered owner to device|Add registered users to device|Update device|Enroll device)$/
| event.outcome = "success"
| groupBy(
    [
      azure.auditlogs.initiated_by.user.user_principal_name,
      azure.auditlogs.initiated_by.user.ip_address
    ],
    function=[
      count(as=registrationCount),
      collect(
        field=azure.auditlogs.target_resources.0.display_name,
        as=deviceNames
      ),
      collect(
        field=azure.auditlogs.initiated_by.app.display_name,
        as=initiatingApps
      ),
      min(field=@timestamp, as=firstSeen),
      max(field=@timestamp, as=lastSeen)
    ]
  )
| isKnownApp := if(
    initiatingApps
      = /(?i)microsoft intune|intune enrollment|azure active directory connect|microsoft authentication broker|^azure active directory$/,
    "true",
    "false"
  )
| suspicionScore := if(isKnownApp = "false", 2, 0)
| suspicionScore := suspicionScore + if(registrationCount >= 3, 2, 0)
| case {
    registrationCount >= 3 and isKnownApp = "false"
      | alertReason := "Bulk registration by unexpected application" ;
    registrationCount >= 3
      | alertReason := "Bulk device registration (3+ devices in window)" ;
    isKnownApp = "false"
      | alertReason := "Device registration by unexpected application" ;
    *
      | alertReason := "Suspicious device registration"
  }
| where suspicionScore > 0 or registrationCount >= 3
| sort(field=suspicionScore, order=desc)
| table(
    [
      azure.auditlogs.initiated_by.user.user_principal_name,
      azure.auditlogs.initiated_by.user.ip_address,
      registrationCount,
      deviceNames,
      initiatingApps,
      suspicionScore,
      alertReason,
      firstSeen,
      lastSeen
    ]
  )

high severity medium confidence

Data Sources

Azure Active Directory Audit Logs ingested via CrowdStrike Falcon LogScale Azure integration or Falcon Identity Threat Protection feed

Required Tables

azure.auditlogs (LogScale repository)

False Positives

Corporate IT performing bulk device provisioning during onboarding waves or scheduled hardware refresh cycles using approved service accounts that may not exactly match the MDM allowlist regex
Automated Intune enrollment pipelines where the initiating app display name varies slightly across tenant configurations (e.g. 'Microsoft Intune' vs 'Intune Company Portal')
MSP or MSSP technicians performing device enrollment in customer Azure AD tenants via delegated admin portals using their own tenant app identity
CrowdStrike Falcon sensor deployment scripts that trigger Azure AD device registration events as part of endpoint onboarding automation

Last updated: 2026-04-13 Research depth: deep

References (14)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1098.005 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Parent Technique

T1098Account Manipulation

Related Sub-techniques

T1098.001Additional Cloud Credentials T1098.002Additional Email Delegate Permissions T1098.003Additional Cloud Roles T1098.004SSH Authorized Keys T1098.006Additional Container Cluster Roles T1098.007Additional Local or Domain Groups

Device Registration

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Persistence

Popular Detections