Azure AD Device Registration Policy Changes via Audit Logs

title: Azure AD Device Registration Policy Changes via Audit Logs
id: 013e380c-3504-4172-9938-d864fbb1f722
status: test
description: This rule flags audit events where the device registration policy is set. Attackers can use policy changes to weaken device registration requirements, potentially enabling easier registration of devices or aiding defense-impairment and privilege-escalation paths. The detection relies on Azure audit log fields for policy-related activity identification, specifically the activity display name corresponding to setting device registration policies.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: Policy
    ActivityDisplayName: Set device registration policies
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9494bff8-959f-4440-bbce-fb87a208d517
    type: derived