legitimate whfb and passwordless onboarding commonly generate this event, especially for new users or users enrolling from a new network asn. this rule fires only on first-seen combinations of tenant, user, and source asn over 14 days. investigate unexpected asns, users outside the enrollment population, or enrollments preceded by anomalous sign-ins.

Techniques

T1098

Sample rules

Entra ID Windows Hello for Business Credential Registered

source: elastic
technicques:
- T1098

Description

Identifies the first-seen registration of a Windows Hello for Business (WHfB) credential for a Microsoft Entra ID user from a given source ASN in a tenant, based on a prefixed historic window. Enrollment is commonly part of legitimate onboarding or passwordless rollout and is not inherently malicious. Adversaries who have obtained a token that satisfies fresh (NGC) multi-factor authentication, for example by borrowing an existing WHfB key or passkey, can also enroll their own WHfB credential to establish durable, phishing-resistant persistence that survives password resets and standard session revocation. Correlate first-seen enrollments with the sign-in and device state that preceded them.

Detection logic

data_stream.dataset: "azure.auditlogs" and
    azure.auditlogs.operation_name: "Add Windows Hello for Business credential" and
    event.outcome: ("Success" or "success") and
    azure.tenant_id: * and
    azure.auditlogs.properties.initiated_by.user.userPrincipalName: * and
    source.as.number: *