APT29G0016 ↗
Has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.12
tfMITRE ATT&CK sub-technique
Device Registration T1098.005
sub-technique of T1098 Account Manipulation
- Tactics
- Persistence, Privilege Escalation
- Platforms
- Windows, Identity Provider
- Version
- 1.4
- Created
- 04 March 2022
- Last modified
- 22 May 2025
- Contributors
- Pawel Partyka, Microsoft 365 Defender; Mike Moran; Joe Gumke, U.S. Bank; Arad Inbar, Fidelis Security; Arun Seelagan, CISA
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.7
Detection rules69th pct
Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.Device Registration MITRE reference T1098.005
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the Set-CASMailbox command.1
All 2 campaigns for this technique
Offense vs defense T1098.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 6
first rule: 2022 Q4 · 2 of 2 campaigns plottedDevice Registration detection strategy DET0036
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Suspicious Device Registration via Entra ID or MFA Platform
2 platforms
AN0103 · Identity Provider
Adversary registers new devices to compromised user accounts to bypass MFA or conditional access policies via Azure Entra ID, Okta, or Duo self-enrollment portals.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | azure:audit | Operation IN ("Add device", "Add registered users to device", "Add registered owner to device") |
| Application Log ContentDC0038 | ApplicationLog:EntraIDPortal | DeviceRegistration events |
| Active Directory Object CreationDC0087 | azure:audit | New device object creation |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ActorUserPrincipalName | Define expected admin users to exclude known enrollment behavior |
| IP Address | Scope internal vs. external device enrollment sources |
| TimeWindow | Adjust for expected hours of legitimate self-enrollment |
AN0104 · Windows
Adversary registers a Windows device to Entra ID or bypasses conditional access by adding device via Intune registration pipeline using stolen credentials.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | ApplicationLog:Intune/MDM Logs | Enrollment events (e.g., MDMDeviceRegistration) |
| Active Directory Object CreationDC0087 | WinEventLog:Security | Device Object Creation |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DeviceNamePattern | Adjust pattern matching logic for unusual or non-corporate device names |
| UserContext | Correlate with prior logon location or device usage behavior |
| EnrollmentMethod | Distinguish between MDM vs manual onboarding vs automated scripts |
Require multi-factor authentication to register devices in Entra ID. Configure multi-factor authentication systems to disallow enrolling new devices for inactive accounts. When first enrolling MFA, use conditional access policies to restrict device enrollment to trusted locations or devices, and consider using temporary access passes as an initial MFA solution to enroll a device.