Detects Entra ID deviceless Windows Hello sign-ins followed by device registration within a 15-minute window, indicating a phishing-resistant credential being used without a bound device and then registering an attacker-controlled device to obtain a long-lived token (PRT) for persistence. The rule correlates two event types: (1) a successful sign-in authenticated by a device-bound credential (Windows Hello for Business, FIDO2, or a passkey) with an empty device_id, and (2) a subsequent device registration (Register device, Add registered owner to device, or Add device) as reported in Entra ID Audit logs. The correlation uses Esql fields such as actor_user_id, signin_time, and register_time, with signin_time derived from authentication_details and register_time derived from the registration audit event. The detection requires the sign-in to occur first and a registration event to occur within 0–900 seconds (15 minutes). It outputs the enriched sign-in event tied to the registration, aiding investigations into the “borrowing Windows Hello keys” technique where a deviceless key is minted and used to register a rogue device, enabling a device-bound PRT for persistence. The rule maps to MITRE ATT&CK techniques T1098 (Device Registration) and T1550 (Use Alternate Authentication Material), reinforcing both persistence and defense evasion goals. Important prerequisites include enabling Microsoft Entra ID sign-in and audit logs collection. False positives cover legitimate onboarding where a user registers a device in the same session or authorized red-team engagements; remediation guidance emphasizes removing rogue devices, revoking tokens and sessions, re-enrolling from trusted devices, and enforcing compliant-device requirements via Conditional Access. References explain the technique and token phishing context. The rule carries a high severity with risk_score 73 and is designed for Azure/Entra ID environments with an event-ingest timestamping approach.