MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1098.005` Device Registration

Sub-technique of T1098 Account Manipulation

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT29

Sigma rules to hunt it

Windows LAPS Credential Dump From Entra IDhightest · azure

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.