Detection: Microsoft Intune Manual Device Management

Updated Date: 2025-01-07 ID: 5ca7ebee-4ee7-4cf2-b3be-0ea26a00d822 Author: Dean Luxton Type: Hunting Product: Splunk Enterprise Security

Description

Microsoft Intune device management configuration policies, scripts & apps are a all tools administrators can use to remotely manage intune managed devices. Instead of waiting for the devices to poll for changes to polciies, the policies can be manually pushed to expidite delivery. This may be useful in a pinch, it may also be a sign of an impatient attacker trying to speed up the delivery of their payload. This detection identifies when a device management configuration policy sync events, on-demand remediation scripts are triggered or when devices are remotely restarted.

Search

1`azure_monitor_activity` operationName="*ManagedDevice*"  
2| rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin 
3| rex field="operationName" "^(?P<action>\w+)\s" 
4| table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId 
5| `microsoft_intune_manual_device_management_filter`

Data Source

Name	Platform	Sourcetype	Source
Azure Monitor Activity	Azure	`'azure:monitor:activity'`	`'Azure AD'`

Macros Used

Name	Value
azure_monitor_activity	`sourcetype=azure:monitor:activity`
microsoft_intune_manual_device_management_filter	`search *`

microsoft_intune_manual_device_management_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1021.007	Cloud Services	Lateral Movement
T1072	Software Deployment Tools	Execution
T1529	System Shutdown/Reboot	Lateral Movement

Actions on Objectives

Exploitation

Installation

DE.AE

CIS 10

APT29

Scattered Spider

APT32

Sandworm Team

Silence

Threat Group-1314

APT37

APT38

Lazarus Group

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	False

This configuration file applies to all detections of type hunting.

Implementation

The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.

Known False Positives

Legitimate adminstrative usage of this functionality will trigger this detection.

Associated Analytic Story

Azure Active Directory Account Takeover

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`Azure AD`	`azure:monitor:activity`
Integration	✅ Passing	Dataset	`Azure AD`	`azure:monitor:activity`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1