Entra device registration with Forg365- naming prefix
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
YARA-L
