Entra ID Device Registration Shortly After Device Code Token Capture

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•2

Detects suspicious device registration or join events occurring within 60 minutes of a Device Code authentication flow. This pattern is consistent with the ARToken post-compromise technique, where an adversary uses an intercepted authentication code to register a new device to maintain persistent access to an Entra ID (Azure AD) environment.