Azure AD Suspicious Device Registration

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)". This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments. Device registration can support persistence or provide a device identity that can be used to access internal resources. If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.