ATTACK-T1098.005Active

Device Registration

Statement

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022)

Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025)

Devices registered in Entra ID may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT)

Location

Tactic: Persistence

Technique Details

Identifier: ATTACK-T1098.005
Parent Technique: ATTACK-T1098
ATT&CK Page: View on MITRE

Tactics

PersistencePrivilege Escalation

Platforms

WindowsIdentity Provider

Detection

Suspicious Device Registration via Entra ID or MFA Platform

Mitigations

Multi-factor Authentication: Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include:

Something you know: Passwords, PINs.
Something you have: Physical tokens, smartphone authenticator apps.
Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans.

Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access. This mitigation can be implemented through the following measures:

Identity and Access Management (IAM):

Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles.
Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations).
Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra.

Authentication Tools and Methods:

Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP).
Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security.
Enforce biometric authentication for compatible devices and applications.

Secure Legacy Systems:

Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet.
Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins.

Monitoring and Alerting:

Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems.
Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations.

Training and Policy Enforcement:

Educate employees on the importance of MFA and secure authenticator usage.
Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

EquivalentPartialRelated

SP 800-53

SP800-53-AC-2relatedvia ctid-attack-to-sp800-53

SP800-53-AC-20relatedvia ctid-attack-to-sp800-53

SP800-53-AC-3relatedvia ctid-attack-to-sp800-53

SP800-53-AC-5relatedvia ctid-attack-to-sp800-53

SP800-53-AC-6relatedvia ctid-attack-to-sp800-53

View in graph Report an issue

← Back to Persistence

Something you know: Passwords, PINs.
Something you have: Physical tokens, smartphone authenticator apps.
Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans.

Identity and Access Management (IAM):

Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles.
Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations).
Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra.

Authentication Tools and Methods:

Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP).
Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security.
Enforce biometric authentication for compatible devices and applications.

Secure Legacy Systems:

Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet.
Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins.

Monitoring and Alerting:

Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems.
Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations.

Training and Policy Enforcement:

Educate employees on the importance of MFA and secure authenticator usage.
Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

Device Registration

Statement

Location

Technique Details

Tactics

Platforms

Detection

Mitigations

Cross-Framework Mappings7

Device Registration

Statement

Location

Technique Details

Tactics

Platforms

Detection

Mitigations

Cross-Framework Mappings7