Azure AD DRS Phantom Device OS Metadata Spoof or Batch Registration
Detects anomalous Azure AD device registration events where device metadata is inconsistent, suggesting impersonation. The rule flags Linux hosts masquerading as Windows, non-Windows devices claiming AzureAD trust type, or the use of zeroed OS versions (0.0.0.0). High-frequency registrations (3+ devices per user in 30 minutes) correlate with known AADInternals-based attacks used by threat actor Storm-2372 to bypass Conditional Access policies.
YARA-L
