T1098.005 — Device Registration

Tactics: Persistence, Privilege Escalation · Platforms: Windows, Identity Provider

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta,…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (2)

title: "T1098.005 Account Manipulation: Device Registration"
id: a483f076-42ec-4d9c-aeaf-efb3d0854e4d
description: 'Suspicious Device Registration via Entra ID or MFA Platform. (Data Component: Active Directory Object Creation; baseline tier: fallback.) Tune using: DeviceNamePattern, UserContext, EnrollmentMethod.'
references:
  - https://attack.mitre.org/techniques/T1098/005
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.005

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName:
      - 'Add device'
      - 'Register device'
      - 'Add registered owner to device'

  condition: selection

falsepositives:
  - Normal user onboarding and self-service device enrollment through Intune or Entra join generate these operations routinely.

level: medium

title: "T1098.005 Account Manipulation: Device Registration"
id: 05290865-c5bb-40a5-af8a-c65e937fc1ac
description: 'Suspicious Device Registration via Entra ID or MFA Platform. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: ActorUserPrincipalName, IP Address, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1098/005
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.005

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName:
      - 'Add device'
      - 'Register device'
      - 'Add registered owner to device'

  condition: selection

falsepositives:
  - Legitimate device enrollment through Intune Autopilot or bulk provisioning workflows.

level: medium

Related sub-techniques

• T1098.004 SSH Authorized Keys
• T1098.002 Additional Email Delegate Permissions
• T1098.001 Additional Cloud Credentials
• T1098.003 Additional Cloud Roles
• T1098.006 Additional Container Cluster Roles
• T1098.007 Additional Local or Domain Groups

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1098.005 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan