↳ GitHub sourceAnalytics ruleMedium
StealthTalk - Multi new devices registration
Description
Identifies a single StealthTalk user registering two or more previously-unseen devices within
a 24-hour window. Sudden registration of multiple new devices is a strong indicator of
account takeover (an attacker enrolling their own device after credential theft) or
device-farm abuse.
The rule fires when a user produces two or more distinct NewDeviceId values within the
lookback window, regardless of operating system. Look at the OSList custom detail to spot
cross-platform patterns (e.g. an iOS-only user suddenly enrolling an Android device).
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 30m
- Query period
- 1d
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let LookbackPeriod = 24h;
let MinNewDevices = 2;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "NewDeviceLogin"
| summarize
NewDeviceCount = dcount(NewDeviceId),
NewDevices = make_set(NewDeviceId),
NewDeviceOSList = make_set(NewDeviceOS),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
AppVersions = make_set(AppVersion)
by UserId
| where NewDeviceCount >= MinNewDevices
| extend
AlertName = "MultiNewDevicesRegistration",
AlertDetails = strcat(
"User ", UserId,
" registered ", NewDeviceCount, " new devices within 24 hours.",
" Device IDs: ", tostring(NewDevices), ".",
" Operating systems: ", tostring(NewDeviceOSList), "."
)
| project
TimeGenerated = LastSeen,
UserId, NewDeviceCount, NewDevices, NewDeviceOSList,
FirstSeen, LastSeen, AppVersions, AlertName, AlertDetails
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC