Device Registration after ROPC Authentication
This detection identifies cases where a successful device registration event in Azure AD occurs shortly after a successful Resource Owner Password Credentials (ROPC) authentication to Microsoft Intune Enrollment via the Microsoft Authentication Broker. Microsoft allows specific application and resource combinations access without a previously registered device. An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process. An attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days. The following query joins ROPC successful sign-ins, to successful device registrations. Registrations that occur soon after a ROPC event (2 days in this instance) could be an indicator of abuse.
Microsoft Sentinel (KQL)
