Unusual Device Registration in Entra ID
This rule detects suspicious device registration activity in Azure Active Directory (now Entra ID). Specifically, it looks for a sequence of two events: first, a 'Device Registration Service' adding a device with 'CloudAccountEnabled' set to true and a specific Windows build number (10.0.19041.928) in the user agent, followed by an attempt to add registered users to the device, referencing 'urn:ms-drs:enterpriseregistration.windows.net'. This sequence could indicate an adversary attempting to register a new device to bypass conditional access policies or gain persistent access.
Sigma
