LoFP LoFP / authorized red team or penetration testing that uses roadtools or phishing-kit infrastructure to register devices will match this rule. if this is expected, add exceptions for the specific user principal names, source ips, or device names involved.

Techniques

Sample rules

Entra ID Register Device with Phishing Kit or ROADtools User Agent

Description

Detects a successful Microsoft Entra ID Register device audit event for an Azure AD join or Azure AD register whose user agent is a Dsreg client string hardcoded by device-registration tooling. “Dsreg/10.0 (Windows 10.0.19045.2006)” is the frozen user agent used by device code and adversary-in-the-middle (AiTM) phishing-as-a-service kits such as Tycoon2FA and Kali365 when they register a device after capturing a victim session. “Dsreg/10.0 (Windows 10.0.19041.928)” is the default user agent used by ROADtools (roadtx) for Windows device registration. Adversaries register these devices to obtain a Primary Refresh Token (PRT) and persist access that survives password resets and user-level session revocation.

Detection logic

data_stream.dataset:"azure.auditlogs" and event.action:"Register device" and
event.outcome:(success or Success) and
azure.auditlogs.properties.userAgent:(
    "Dsreg/10.0 (Windows 10.0.19041.928)" or
    "Dsreg/10.0 (Windows 10.0.19045.2006)"
) and
azure.auditlogs.properties.additional_details.value:("Azure AD join" or "Azure AD register")