Virtual Device Registration for Primary Refresh Token Capture

Smarth Arora@smarthxarora

•updated Jul 6, 2026•0•0•2

This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.