LoFP / a legitimate, never-patched windows 10 host at build `10.0.19041.928` (20h1) or `10.0.19045.2006` (22h2) can present the same dsreg user agent during a genuine azure ad join or register. validate the device name, owner, and patch level against your device inventory before escalating.

Techniques

• T1098

Sample rules

Entra ID Register Device with Phishing Kit or ROADtools User Agent

• source: elastic
• technicques:
  • T1098

Description

Detects a successful Microsoft Entra ID Register device audit event for an Azure AD join or Azure AD register whose user agent is a Dsreg client string hardcoded by device-registration tooling. “Dsreg/10.0 (Windows 10.0.19045.2006)” is the frozen user agent used by device code and adversary-in-the-middle (AiTM) phishing-as-a-service kits such as Tycoon2FA and Kali365 when they register a device after capturing a victim session. “Dsreg/10.0 (Windows 10.0.19041.928)” is the default user agent used by ROADtools (roadtx) for Windows device registration. Adversaries register these devices to obtain a Primary Refresh Token (PRT) and persist access that survives password resets and user-level session revocation.

Detection logic

data_stream.dataset:"azure.auditlogs" and event.action:"Register device" and
event.outcome:(success or Success) and
azure.auditlogs.properties.userAgent:(
    "Dsreg/10.0 (Windows 10.0.19041.928)" or
    "Dsreg/10.0 (Windows 10.0.19045.2006)"
) and
azure.auditlogs.properties.additional_details.value:("Azure AD join" or "Azure AD register")