GraphSpy-Device Registration in Entra ID AuditLogs Post Device-Code Auth
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Cortex XDR
