Clankerusecase
MITRE ATT&CK detection coverage
← Back to main site
Home/ MITRE Matrix/ Persistence/ T1098.005

T1098.005Device Registration

T1098.005 — Device Registration is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 9 detection use cases covering it and 2 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
9Use cases
2Articles
0Sub-techniques
2Tactics

Use cases covering this technique (9)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD Okta New Device Enrolled on Account ESCU actions · alerting P PingID Mismatch Auth Source and Verification Response ESCU actions · alerting P PingID New MFA Method After Credential Reset ESCU actions · alerting P PingID New MFA Method Registered For User ESCU actions · alerting P Azure AD New MFA Method Registered ESCU actions · alerting P O365 New MFA Method Registered ESCU actions · alerting P [LLM] Entra ID sign-in or session from Storm-2945 AiTM device-code phishing infrastructure Bespoke actions · hunting DSΣPDD [LLM] Iran-aligned MFA push-bombing followed by new auth method registered (AA24-290A) Bespoke actions · alerting DSP

Articles citing this technique (2)