From 1303fb94c1c7b57d1aa7e750a64f4d4565161e38 Mon Sep 17 00:00:00 2001
From: Jake Enea <91490989+jakeenea51@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:06:28 -0400
Subject: [PATCH] adding aad suspicious device registration dataset

---
 .../azure_ad_suspicious_device_registration.log     |  3 +++
 .../azure_ad_suspicious_device_registration.yml     | 13 +++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.log
 create mode 100644 datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.yml

diff --git a/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.log b/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.log
new file mode 100644
index 000000000..5c9cfbe1e
--- /dev/null
+++ b/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7d1c4f09f999747446560f3a4fe6c62247a41f3424b8827aeecff5f765f025b6
+size 16966
diff --git a/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.yml b/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.yml
new file mode 100644
index 000000000..865ddf7ef
--- /dev/null
+++ b/datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.yml
@@ -0,0 +1,13 @@
+author: Jake Enea
+id: 9d833380-b164-4b1d-8d4f-49a6cf62df5f
+date: '2026-10-12'
+description: Successful Azure AD device registrations with suspicious device names and user agents. Tenant-specific details have been replaced in the dataset including tenant ID, usernames, IPs, etc.
+environment: attack_range
+directory: azure_ad_suspicious_device_registration
+mitre_technique:
+- T1098.005
+datasets:
+- name: azure_ad_suspicious_device_registration
+  path: /datasets/attack_techniques/T1098.005/azure_ad_suspicious_device_registration/azure_ad_suspicious_device_registration.log
+  sourcetype: azure:monitor:aad
+  source: azure