Account Manipulation: Device Registration T1098.005

Tactics: Persistence, Privilege Escalation

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Authoring guide

Patterns shared across the 22 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (65 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
data_stream.dataset14eq 14azure.auditlogs, azure.signinlogs, google_workspace.device, o365.audit, aws.cloudtrail
EventType10eq 8, in 2DEVICE_REGISTER_UNREGISTER_EVENT, Register device, Add device, Add registered users to device., CreateVirtualMFADevice
"result.message"3contains 1, in 1, starts_with 1device paired, *Action: Allowed*, *Action: Approve*, *Action: Authenticate*
Provider_Name3eq 3Exchange, Microsoft Entra ID, iam.amazonaws.com
azure_ad::user_type3eq 3Member
event.outcome3eq 2, in 1success, Success
gws::device_account_state3eq 3REGISTERED
azure.auditlogs.properties.additional_details.value2eq 2, starts_with 1Azure AD join, DeviceRegistrationClient, Dsreg/, Microsoft.OData.Client/
azure.signinlogs.properties.incoming_token_type2eq 2refreshToken, primaryRefreshToken
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status2eq 2unbound
azure_ad::app_id2eq 229d9ed98-a469-4536-ade2-f981bc1d605e
azure_ad::resource_display_name2eq 1, ne 1Device Registration Service
azure_ad::signin_category2eq 2NonInteractiveUserSignInLogs
propertyName2eq 1, in 1StrongAuthenticationMethod, StrongAuthenticationPhoneAppDetail
source.as.number2in 2132203, 136787, 14061, 204957, 215540

Top indicator values (171 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
data_stream.dataseteq
azure.auditlogs
420
data_stream.dataseteq
azure.signinlogs
430
data_stream.dataseteq
google_workspace.device
22
data_stream.dataseteq
o365.audit
245
azure_ad::user_typeeq
Member
310
gws::device_account_stateeq
REGISTERED
33
EventTypeeq
DEVICE_REGISTER_UNREGISTER_EVENT
22
EventTypeeq
Register device
22
azure.signinlogs.properties.incoming_token_typeeq
refreshToken
22
azure.signinlogs.properties.token_protection_status_details.sign_in_session_statuseq
unbound
23
azure_ad::app_ideq
29d9ed98-a469-4536-ade2-f981bc1d605e
27
azure_ad::signin_categoryeq
NonInteractiveUserSignInLogs
22
event.outcomeeq
success
2251
source.as.numberin
204957
22
source.as.numberin
215540
22
source.as.numberin
29802
22
source.as.numberin
395092
22
source.as.numberin
45102
22
source.as.numberin
62240
22
source.as.numberin
9009
23
"resources{}.ipaddress"eq
*
1
"result.message"contains
device paired
1
"result.message"in
*Action: Allowed*
1
"result.message"in
*Action: Approve*
1
"result.message"in
*Action: Authenticate*
1
"result.message"starts_with
device paired
1
"result.status"eq
POLICY
1
"result.status"in
FAIL*
1
"result.status"in
SUCCESS*
1
"result.status"in
UNSUCCESSFUL*
1

Exclusions (14 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
"result.message"in
*create*
1
"result.message"in
*delete*
1
"result.message"in
*pair*
1
aws::userAgenteq
Windows-AzureAD-Authentication-Provider/1.0
1
azure.auditlogs.properties.userAgenteq
DeviceRegistrationClient
1
azure.auditlogs.properties.userAgentstarts_with
Dalvik
1
azure.auditlogs.properties.userAgentstarts_with
Dsreg
1
azure.signinlogs.properties.device_detail.is_managedeq
true
1
azure_ad::app_display_nameeq
Windows Sign In
1
o365.audit.AffectedItems.Subjectcontains
log in
1
o365.audit.AffectedItems.Subjectcontains
log-in
1
o365.audit.AffectedItems.Subjectcontains
logon
1
o365.audit.AffectedItems.Subjectcontains
sign in
1
o365.audit.AffectedItems.Subjectcontains
sign-in
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 1 rule

Elastic 15 rules

Splunk 6 rules