Elastic Security Detection Rules

Microsoft Entra ID Protection Alert and Device Registration

Last updated 24 days ago on 2025-09-30
Created 6 months ago on 2025-04-30

About

Identifies sequence of events where a Microsoft Entra ID protection alert is followed by an attempt to register a new device by the same user principal. This behavior may indicate an adversary using a compromised account to register a device, potentially leading to unauthorized access to resources or persistence in the environment.
Tags
Domain: CloudData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Protection LogsData Source: Microsoft Entra ID Audit LogsUse Case: Identity and Access AuditTactic: PersistenceLanguage: eql
Severity
high
Risk Score
73
MITRE ATT&CK™

Persistence (TA0003)(opens in a new tab or window)

↳ Account Manipulation (T1098)(opens in a new tab or window)

↳ Valid Accounts (T1078)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-azure.identity_protection-*logs-azure.auditlogs-*
Related Integrations

azure(opens in a new tab or window)

Query
sequence with maxspan=5m
[any where event.dataset == "azure.identity_protection"] by azure.identityprotection.properties.user_principal_name
[any where event.dataset == "azure.auditlogs" and event.action == "Register device"] by azure.auditlogs.properties.initiated_by.user.userPrincipalName

Install detection rules in Elastic Security

Detect Microsoft Entra ID Protection Alert and Device Registration in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).