Suspicious Device Registration Name
This rule detects suspicious device registration operations in a tenant by identifying device names that match known automated device code phishing kit patterns. Specifically, it looks for device names that are in the format of 'DESKTOP-' followed by 6 to 8 hexadecimal characters, which deviates from typical Windows default naming conventions. This pattern is often used by attackers to register devices for persistence or to bypass MFA.
Microsoft Sentinel (KQL)
