PRT Registration to ms-drs
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
Microsoft Sentinel (KQL)
