Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.
Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.
Devices registered in Azure AD may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Azure AD tenant by registering a large number of devices.
|ID||Data Source||Data Component||Detects|
|DS0026||Active Directory||Active Directory Object Creation||
Monitor for the registration or joining of new device objects in Active Directory.
|DS0015||Application Log||Application Log Content||
Azure AD creates several log entries when new devices are enrolled, which can be monitored for unexpected device registrations. Additionally, joined devices can be viewed via the Azure AD portal.
|DS0002||User Account||User Account Modification||
Monitor user accounts for new and suspicious device associations, such as those originating from unusual sources, occurring at unusual times, or following a suspicious login.