Technique on mitre.org

T1098.005: Device Registration

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network. In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account.

Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.

Devices registered in Azure AD may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Azure AD tenant by registering a large number of devices.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

— Monitoring of events with ID 5137 (Microsoft-Windows-Security-Auditing). — Monitoring of events with IDs 4103 and 4104 (Microsoft-Windows-PowerShell/Operational) related to execution of cmdlets Join-AADIntDeviceToAzureAD and Join-AADIntOnPremDeviceToAzureAD (of the AADInternals module).

Expert Required. The technique is detected only with the combination of «PT Product + Expert»

Detection

ID	DS0002	Data source and component	User Account: User Account Modification	Description	Monitor user accounts for new and suspicious device associations, such as those originating from unusual sources, occurring at unusual times, or following a suspicious login.

ID	DS0026	Data source and component	Active Directory: Active Directory Object Creation	Description	Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.

ID	DS0015	Data source and component	Application Log: Application Log Content	Description	Azure AD creates several log entries when new devices are enrolled, which can be monitored for unexpected device registrations. Additionally, joined devices can be viewed via the Azure AD portal.

ID	Data source and component	Description
DS0002	User Account: User Account Modification	Monitor user accounts for new and suspicious device associations, such as those originating from unusual sources, occurring at unusual times, or following a suspicious login.
DS0026	Active Directory: Active Directory Object Creation	Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.
DS0015	Application Log: Application Log Content	Azure AD creates several log entries when new devices are enrolled, which can be monitored for unexpected device registrations. Additionally, joined devices can be viewed via the Azure AD portal.

Mitigation

ID	M1032	Name	Multi-factor Authentication	Description	Require multi-factor authentication to register devices in Azure AD. Configure multi-factor authentication systems to disallow enrolling new devices for inactive accounts. When first enrolling MFA, use conditional access policies to restrict device enrollment to trusted locations or devices, and consider using temporary access passes as an initial MFA solution to enroll a device.

ID	Name	Description
M1032	Multi-factor Authentication	Require multi-factor authentication to register devices in Azure AD. Configure multi-factor authentication systems to disallow enrolling new devices for inactive accounts. When first enrolling MFA, use conditional access policies to restrict device enrollment to trusted locations or devices, and consider using temporary access passes as an initial MFA solution to enroll a device.