Detect Device Registration in Google Chronicle

// Rule 1 — Single registration by unexpected application
rule t1098_005_device_registration_unexpected_app {
  meta:
    author        = "Argus Detection Engineering"
    description   = "Detects Azure AD / Entra ID device registration initiated by an application outside the known MDM allowlist — consistent with adversary-controlled enrollment via AADInternals or similar tooling (T1098.005)"
    mitre_tactic  = "Persistence, Privilege Escalation"
    mitre_technique = "T1098.005"
    severity      = "HIGH"
    priority      = "HIGH"
    reference     = "https://attack.mitre.org/techniques/T1098/005/"

  events:
    $e.metadata.vendor_name      = "Microsoft"
    $e.metadata.product_name     = "Azure Active Directory"
    $e.metadata.event_status     = "SUCCESS"
    (
      $e.metadata.product_event_type = "Add device" or
      $e.metadata.product_event_type = "Register device" or
      $e.metadata.product_event_type = "Add registered owner to device" or
      $e.metadata.product_event_type = "Add registered users to device" or
      $e.metadata.product_event_type = "Update device" or
      $e.metadata.product_event_type = "Enroll device"
    )
    not $e.principal.application = /(?i)microsoft intune|intune enrollment|azure active directory connect|microsoft authentication broker|^azure active directory$/
    $e.principal.user.email_addresses[0] != ""
    $user = $e.principal.user.email_addresses[0]

  condition:
    $e
}


// Rule 2 — Bulk device registration (3+ devices from same user within 1 hour)
rule t1098_005_bulk_device_registration {
  meta:
    author        = "Argus Detection Engineering"
    description   = "Detects bulk Entra ID device enrollment — 3 or more successful device registrations from the same user within 1 hour — consistent with AADInternals Register-AADIntJoinedDevice automation and APT29 lateral-movement tradecraft (T1098.005)"
    mitre_tactic  = "Persistence, Privilege Escalation"
    mitre_technique = "T1098.005"
    severity      = "HIGH"
    priority      = "HIGH"
    reference     = "https://attack.mitre.org/techniques/T1098/005/"

  events:
    $e.metadata.vendor_name  = "Microsoft"
    $e.metadata.product_name = "Azure Active Directory"
    $e.metadata.event_status = "SUCCESS"
    (
      $e.metadata.product_event_type = "Add device" or
      $e.metadata.product_event_type = "Register device" or
      $e.metadata.product_event_type = "Enroll device"
    )
    $e.principal.user.email_addresses[0] != ""
    $user = $e.principal.user.email_addresses[0]

  match:
    $user over 1h

  condition:
    #e >= 3
}