This anomaly rule detects suspicious Azure Active Directory (Azure AD) device registrations by monitoring AuditLog events for operationName = "Register device" and filtering on device names that match common desktop/workstation patterns or a specific user agent associated with ROADtools usage. Specifically, it targets targetResources.displayName values like "*-PC", "DESKTOP-*", "EC2AMAZ-*", "LAPTOP-*", "MININT-*", "MSEDGEWIN10", "WIN-*" or a user agent of Dsreg/10.0 (Windows 10.0.19041.928). Such registrations can indicate attacker activity aiming to establish a device identity for persistence or to gain access to internal resources. The search is designed for the azure:monitor:aad sourcetype and uses the Splunk Add-on for Microsoft Cloud Services, renaming fields to dvc and user_agent, handling nulls, and aggregating results by tenantId, user, src, dvc, signature, vendor_account, and vendor_product to produce first/last seen times and the resulting outcomes. This correlates with Azure AD persistence or account takeover motivations. Implementing this rule helps surface suspicious device registrations that could enable ongoing access to the environment if malicious. Known false positives include legitimate device registrations that match the suspicious naming patterns; tuning may be required. References include guidance on Entra/AAD device registration abuse and ROADtools, and the detection is paired with risk and analytics storytelling in the SIEM.