Azure Sign-in Logs: Device Registration or Join Successful Without MFA

title: "Azure Sign-in Logs: Device Registration or Join Successful Without MFA"
id: 8e2fbdf4-c618-458d-9bab-076abf78809a
status: test
description: Identifies successful device registration or join events in Azure sign-in logs where Conditional Access indicates MFA was not performed. Attackers may register or join devices to gain access or persist without completing multi-factor authentication. The detection relies on sign-in log fields for successful operations against the Device Registration Service and absence of the MFA requirement indicator.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResourceDisplayName: Device Registration Service
    conditionalAccessStatus: success
  filter_mfa:
    AuthenticationRequirement: multiFactorAuthentication
  condition: selection and not filter_mfa
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5afa454e-030c-4ab4-9253-a90aa7fcc581
    type: derived