Sub-technique of T1098 Account Manipulation.View on attack.mitre.org
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network. In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account.
Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.
Devices registered in Entra ID may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Entra ID tenant by registering a large number of devices.
Rules on DetectionCode tagged with T1098.005.
| Rule | Level | Log source |
|---|---|---|
| Windows LAPS Credential Dump From Entra ID | high | azure / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Azure AD New MFA Method Registered | TTP | NULL | Azure Active Directory Update user |
| O365 New MFA Method Registered | TTP | NULL | O365 Update user. |
| Okta New Device Enrolled on Account | TTP | NULL | Okta |
| PingID Mismatch Auth Source and Verification Response | TTP | NULL | PingID |
| PingID New MFA Method After Credential Reset | TTP | NULL | PingID |
| PingID New MFA Method Registered For User | TTP | NULL | PingID |
| Used by | Procedure example |
|---|---|
| GroupAPT29 | APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account. |
| Used by | Procedure example |
|---|---|
| ToolAADInternals | AADInternals can register a device to Azure AD. |
| Used by | Procedure example |
|---|---|
| CampaignC0027 | During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN. |
| CampaignSolarWinds Compromise | During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
