AN0103
Analytic 0103
Identity Provider
Adversary registers new devices to compromised user accounts to bypass MFA or conditional access policies via Azure Entra ID, Okta, or Duo self-enrollment portals.
azure:audit
Operation IN ("Add device", "Add registered users to device", "Add registered owner to device")
ApplicationLog:EntraIDPortal
DeviceRegistration events
azure:audit
New device object creation
[ActorUserPrincipalName]
Define expected admin users to exclude known enrollment behavior
[IP Address]
Scope internal vs. external device enrollment sources
[TimeWindow]
Adjust for expected hours of legitimate self-enrollment
AN0104
Analytic 0104
Windows
Adversary registers a Windows device to Entra ID or bypasses conditional access by adding device via Intune registration pipeline using stolen credentials.
WinEventLog:Security
Device Object Creation
ApplicationLog:Intune/MDM Logs
Enrollment events (e.g., MDMDeviceRegistration)
[DeviceNamePattern]
Adjust pattern matching logic for unusual or non-corporate device names
[UserContext]
Correlate with prior logon location or device usage behavior
[EnrollmentMethod]
Distinguish between MDM vs manual onboarding vs automated scripts