How to Detect and Prevent Rogue Device Registrations in Microsoft Entra ID
Summary
Attackers use phishing to register rogue Entra ID devices and bypass Conditional Access. The article recommends detecting anomalous naming and correlating device-code sign-ins with registrations, and suggests policy controls to limit abuse.
Key points
- Attackers can use stolen authorization, including tokens obtained through device-code phishing, to register rogue devices and satisfy Conditional Access requirements.
- Wiz reports that nearly one in seven Entra ID environments experienced at least one such attack during a 90-day period.
- Attackers have moved beyond predictable device names and User-Agent strings, making static indicators easier to evade.
- Detect devices that break an organization's naming conventions and correlate device-code phishing alerts with subsequent registrations.
- Requiring MFA for device registration can block password-only compromises, but may not stop attackers using tokens from phishing or adversary-in-the-middle attacks.
- Restricting device registration to corporate IP addresses or requiring compliant devices can further reduce risk.
- The article includes a KQL query to identify tenant device-naming conventions and assess whether DESKTOP-prefixed registrations are unusual.
Article Details
- Defense Focus
- Detect and prevent rogue Entra ID device registrations by identifying anomalous device names and correlating device-code phishing activity with subsequent registrations.
- Detection Methods
- Baseline device naming conventions within each tenant and flag newly registered devices whose display names deviate from the established pattern.
- Correlate device-code phishing alerts with subsequent device registration events to investigate the sequence as a potential attack chain.
- Use AI-generated identifier ideas as hunting hypotheses, then validate them against behavioral context and telemetry rather than treating unfamiliar names or User-Agent strings as proof.
- Use KQL to calculate the proportion of devices named with the DESKTOP- prefix in successful sign-in telemetry and identify tenants where that pattern is rare.
- Data Sources
- Entra ID device registration events
- SigninLogs, including ResultType, OperationName, DeviceDetail deviceId, and displayName fields
- Device-code authentication and phishing alerts
- User-Agent strings observed in device-registration and sign-in activity
- Device registration source infrastructure and IP addresses
- Rule Types
- Device naming-convention anomaly detection
- Sequential event correlation
- Detection rules for known-toolkit device registrations, suspicious registrations, anomalous DESKTOP registrations, device-code phishing IP mismatches, potential device-code phishing, and unusual device-code flows
- KQL hunting query for tenant device-naming baselines
- Platforms
- Entra ID
- Wiz Defend
- Defensive Actions
- Require MFA for device registration through Conditional Access, while accounting for tokens obtained through device-code phishing or AiTM after the victim has completed MFA.
- Consider restricting device registration to known corporate IP addresses or requiring compliant devices.
- On detection, contain the attack, reset credentials, remove unauthorized devices, and block new enrollments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | lockwall[.]xyz | Domain hosting a phishing page that presented victims with a pre-generated Microsoft device code. |
| IPV4 | 3[.]149[.]231[.]11 | AWS IP address observed across device-code sign-ins associated with multiple victims in the described phishing activity. |
MITRE ATT&CK
T1098.005 · Device RegistrationAttackers register rogue devices in a victim's Entra ID environment to satisfy device-based access requirements and establish persistence.T1528 · Steal Application Access TokenThe article describes device-code phishing that obtains authorization used to register a rogue device.
Vendors
Products
Entra IDWe have already observed signs of this shift in Entra ID attacks. Suspicious device registrations are moving beyond predictable conventions like DESKTOP-XXXXXXXX toward generic identifiers such as Work PC.Microsoft 365is successfully registered, attackers typically move on to the objectives that matter most, accessing Microsoft 365 resources, exfiltrating emails, maintaining persistence or expanding their foothold within the tenant.Wiz DefendWiz Defend gives you clear visibility into identity attacks in Entra ID, using real-time alerts to spot the tactics used in device-code phishing and suspicious device registrations.
Tools
ClaudeWe started by asking Claude to analyze unusual User-Agent strings observed in device-registration and sign-in activity, and identify characteristics consistent with AI-generated tooling. One string stood out:KQLKQL ROADReconLooking beneath the surface, however, a common denominator quickly emerges: many attackers relied on ROADrecon, the well-known open-source Entra exploitation framework.