Entra ID 5+ microsoft-*/windows-* device registrations after device code sign-in
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Microsoft Sentinel (KQL)
