Entra ID Register Device with Phishing Kit or ROADtools User Agent

Last updated 13 days ago on 2026-10-07

Created 13 days ago on 2026-10-07

About

Detects a successful Microsoft Entra ID Register device audit event for an Azure AD join or Azure AD register whose user agent is a Dsreg client string hardcoded by device-registration tooling. "Dsreg/10.0 (Windows 10.0.19045.2006)" is the frozen user agent used by device code and adversary-in-the-middle (AiTM) phishing-as-a-service kits such as Tycoon2FA and Kali365 when they register a device after capturing a victim session. "Dsreg/10.0 (Windows 10.0.19041.928)" is the default user agent used by ROADtools (roadtx) for Windows device registration. Adversaries register these devices to obtain a Primary Refresh Token (PRT) and persist access that survives password resets and user-level session revocation.

Tags

Domain: CloudDomain: IdentityData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Audit LogsUse Case: Identity and Access AuditUse Case: Threat DetectionThreat: Tycoon2FAThreat: Kali365Threat: Device Code PhishingThreat: AiTM PhishingTactic: PersistenceRule Type: Custom Query (KQL)Platform: Entra IDLanguage: kuery

Severity

high

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples

A legitimate, never-patched Windows 10 host at build `10.0.19041.928` (20H1) or `10.0.19045.2006` (22H2) can present the same Dsreg user agent during a genuine Azure AD join or register. Validate the device name, owner, and patch level against your device inventory before escalating. Authorized red team or penetration testing that uses ROADtools or phishing-kit infrastructure to register devices will match this rule. If this is expected, add exceptions for the specific user principal names, source IPs, or device names involved.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.auditlogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:"azure.auditlogs" and event.action:"Register device" and
event.outcome:(success or Success) and
azure.auditlogs.properties.userAgent:(
    "Dsreg/10.0 (Windows 10.0.19041.928)" or
    "Dsreg/10.0 (Windows 10.0.19045.2006)"
) and
azure.auditlogs.properties.additional_details.value:("Azure AD join" or "Azure AD register")

Install detection rules in Elastic Security

Detect Entra ID Register Device with Phishing Kit or ROADtools User Agent in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).