GhostCode Kit Rogue Device Registration Naming Pattern

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

This rule detects device registration, joining, or enrollment events where the DeviceDisplayName follows a specific naming pattern (e.g., 'word-word-alphanumeric-word-hash'). It groups these events by device and user to track frequency, which can help identify potentially automated or malicious device registration behavior.