LoFP LoFP / authorized red team or penetration testing engagements that register devices and exercise prts will match this sequence. document the engagement and add scoped exceptions for the involved principals or source addresses.

Sample rules

Entra ID AiTM Phishing-Kit Chain Detected

Description

Identifies a Microsoft Entra ID identity-compromise chain in which a single user, within a 10-minute window, authenticates to the Device Registration Service through the Microsoft Authentication Broker (MAB) client, registers a device, and then uses the resulting Primary Refresh Token (PRT) to access a resource other than the Device Registration Service. This sequence is the core post-adversary-in-the-middle (AiTM) persistence pattern used by phishing kits such as Tycoon2FA and Kali365: after capturing a victim session, the kit registers an Azure AD-joined device to obtain a device-bound PRT, which survives user-level session revocation and password resets and grants trusted, MFA-free access. Correlating the broker sign-in, the device-registration audit event, and the follow-on PRT sign-in for the same user within a short window is a high-fidelity indicator of active account takeover.

Detection logic

sequence with maxspan=3m
  [authentication where
    data_stream.dataset == "azure.signinlogs" and
    azure.signinlogs.category == "NonInteractiveUserSignInLogs" and
    azure.signinlogs.properties.app_id == "29d9ed98-a469-4536-ade2-f981bc1d605e" and
    azure.signinlogs.properties.resource_display_name == "Device Registration Service" and
    azure.signinlogs.properties.incoming_token_type == "refreshToken" and
    azure.signinlogs.properties.token_protection_status_details.sign_in_session_status == "unbound" and
    azure.signinlogs.properties.user_type == "Member" and
    azure.signinlogs.result_signature == "SUCCESS"
  ] by azure.signinlogs.properties.user_id
  [any where
    data_stream.dataset == "azure.auditlogs" and
    azure.auditlogs.operation_name == "Register device" and
    azure.auditlogs.properties.initiated_by.user.id != null and
    azure.auditlogs.properties.target_resources.`0`.display_name like "DESKTOP-*" and
    event.outcome == "success"
  ] by azure.auditlogs.properties.initiated_by.user.id
  [authentication where
    data_stream.dataset == "azure.signinlogs" and
    azure.signinlogs.properties.incoming_token_type == "primaryRefreshToken" and
    azure.signinlogs.properties.original_transfer_method == "deviceCodeFlow" and
    azure.signinlogs.properties.is_interactive == true and
    azure.signinlogs.properties.resource_display_name != "Device Registration Service" and
    azure.signinlogs.properties.device_detail.is_managed != true and
    azure.signinlogs.result_signature == "SUCCESS"
  ] by azure.signinlogs.properties.user_id

Entra ID Device Registration with Phishing Kit Default OS Build

Description

Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is “10.0.19045.2006” and the device display name follows the default “DESKTOP-” pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher “10.0.19045.” value.

Detection logic

data_stream.dataset:"azure.auditlogs" and event.action:"Add device" and
    azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value:*10.0.19045.2006* and
    azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value:*DESKTOP-*

Sample rules

Entra ID AiTM Phishing-Kit Chain Detected

Description

Identifies a Microsoft Entra ID identity-compromise chain in which a single user, within a 10-minute window, authenticates to the Device Registration Service through the Microsoft Authentication Broker (MAB) client, registers a device, and then uses the resulting Primary Refresh Token (PRT) to access a resource other than the Device Registration Service. This sequence is the core post-adversary-in-the-middle (AiTM) persistence pattern used by phishing kits such as Tycoon2FA and Kali365: after capturing a victim session, the kit registers an Azure AD-joined device to obtain a device-bound PRT, which survives user-level session revocation and password resets and grants trusted, MFA-free access. Correlating the broker sign-in, the device-registration audit event, and the follow-on PRT sign-in for the same user within a short window is a high-fidelity indicator of active account takeover.

Detection logic

sequence with maxspan=3m
  [authentication where
    data_stream.dataset == "azure.signinlogs" and
    azure.signinlogs.category == "NonInteractiveUserSignInLogs" and
    azure.signinlogs.properties.app_id == "29d9ed98-a469-4536-ade2-f981bc1d605e" and
    azure.signinlogs.properties.resource_display_name == "Device Registration Service" and
    azure.signinlogs.properties.incoming_token_type == "refreshToken" and
    azure.signinlogs.properties.token_protection_status_details.sign_in_session_status == "unbound" and
    azure.signinlogs.properties.user_type == "Member" and
    azure.signinlogs.result_signature == "SUCCESS"
  ] by azure.signinlogs.properties.user_id
  [any where
    data_stream.dataset == "azure.auditlogs" and
    azure.auditlogs.operation_name == "Register device" and
    azure.auditlogs.properties.initiated_by.user.id != null and
    azure.auditlogs.properties.target_resources.`0`.display_name like "DESKTOP-*" and
    event.outcome == "success"
  ] by azure.auditlogs.properties.initiated_by.user.id
  [authentication where
    data_stream.dataset == "azure.signinlogs" and
    azure.signinlogs.properties.incoming_token_type == "primaryRefreshToken" and
    azure.signinlogs.properties.original_transfer_method == "deviceCodeFlow" and
    azure.signinlogs.properties.is_interactive == true and
    azure.signinlogs.properties.resource_display_name != "Device Registration Service" and
    azure.signinlogs.properties.device_detail.is_managed != true and
    azure.signinlogs.result_signature == "SUCCESS"
  ] by azure.signinlogs.properties.user_id

Entra ID Device Registration with Phishing Kit Default OS Build

Description

Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is “10.0.19045.2006” and the device display name follows the default “DESKTOP-” pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher “10.0.19045.” value.

Detection logic

data_stream.dataset:"azure.auditlogs" and event.action:"Add device" and
    azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value:*10.0.19045.2006* and
    azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value:*DESKTOP-*

Entra ID Phishing Kit Default OS Build (Entity Analytics)

Description

Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default “DESKTOP-” pattern and whose operating system build is “10.0.19045.2006”. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher “10.0.19045.” value, so a device frozen at “.2006” with a default name is a high-fidelity, though evadable, indicator.

Detection logic

data_stream.dataset:"entityanalytics_entra_id.device" and
    event.provider:"Microsoft Entra ID" and
    host.name:DESKTOP-* and host.os.version:"10.0.19045.2006" and
    host.id: *