unmanaged or never-patched windows 10 22h2 hosts may legitimately report the `10.0.19045.2006` build with a default \"desktop-\" host name. validate against your device inventory and patch baseline before escalating.

Techniques

T1098

Sample rules

Entra ID Phishing Kit Default OS Build (Entity Analytics)

source: elastic
technicques:
- T1098

Description

Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default “DESKTOP-” pattern and whose operating system build is “10.0.19045.2006”. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher “10.0.19045.” value, so a device frozen at “.2006” with a default name is a high-fidelity, though evadable, indicator.

Detection logic

data_stream.dataset:"entityanalytics_entra_id.device" and
    event.provider:"Microsoft Entra ID" and
    host.name:DESKTOP-* and host.os.version:"10.0.19045.2006" and
    host.id: *