GhostCode kit-generated Entra device name pattern at registration
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
Microsoft Sentinel (KQL)
