Elastic Security Detection Rules

Entra ID Phishing Kit Default OS Build (Entity Analytics)

Last updated 10 days ago on 2026-06-29
Created 10 days ago on 2026-06-29

About

Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default "DESKTOP-" pattern and whose operating system build is "10.0.19045.2006". This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher "10.0.19045.<revision>" value, so a device frozen at ".2006" with a default name is a high-fidelity, though evadable, indicator.
Tags
Domain: CloudDomain: IdentityData Source: Microsoft Entra IDData Source: Microsoft Entra ID Entity AnalyticsUse Case: Asset VisibilityUse Case: Threat DetectionThreat: Tycoon2FAThreat: Kali365Tactic: PersistenceLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples
Unmanaged or never-patched Windows 10 22H2 hosts may legitimately report the `10.0.19045.2006` build with a default "DESKTOP-" host name. Validate against your device inventory and patch baseline before escalating. Authorized red team or penetration testing engagements that register devices with this OS profile will appear in the device inventory and match this rule. If this is expected, add exceptions for the specific host names or device IDs.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-entityanalytics_entra_id.device-*
Related Integrations

entityanalytics_entra_id(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:"entityanalytics_entra_id.device" and
    event.provider:"Microsoft Entra ID" and
    host.name:DESKTOP-* and host.os.version:"10.0.19045.2006" and
    host.id: *

Install detection rules in Elastic Security

Detect Entra ID Phishing Kit Default OS Build (Entity Analytics) in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).