Detects a successful Microsoft Entra ID (Azure AD) device registration event (Join or Register) where the azure audit log records a Dsreg user agent string that is known to be used by device-registration tooling in phishing kits and dual-use tooling. The rule targets Register device events with azure.auditlogs.properties.additional_details.value set to "Azure AD join" or "Azure AD register" and where azure.auditlogs.properties.userAgent matches one of the two frozen strings: Dsreg/10.0 (Windows 10.0.19041.928) (ROADtools default) or Dsreg/10.0 (Windows 10.0.19045.2006) (Tycoon2FA/Kali365). Adversaries use these device registrations to obtain a device-bound Primary Refresh Token (PRT) and persist access across password resets and user sign-out. Legitimate enrollments on patched Windows builds may occasionally resemble these user agents; the rule is designed to surface rogue device registrations that may indicate preparation for token-based persistence and CA bypass. The query uses the Entra audit log stream (logs-azure.auditlogs-*) to identify successful registrations for further investigation.