Detection: Microsoft Intune Device Health Scripts

Updated Date: 2025-01-06 ID: 6fe42e07-15b1-4caa-b547-7885666cb1bd Author: Dean Luxton Type: Hunting Product: Splunk Enterprise Security

Description

Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection identifies when a new device health script has been added, updated or deleted.

1`azure_monitor_activity` operationName="*DeviceHealthScript*"  
2| rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin 
3| rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" 
4| replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action 
5| table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId 
6| `microsoft_intune_device_health_scripts_filter`

Data Source

Name Platform Sourcetype Source
Azure Monitor Activity Azure icon Azure 'azure:monitor:activity' 'Azure AD'

Macros Used

Name Value
azure_monitor_activity sourcetype=azure:monitor:activity
microsoft_intune_device_health_scripts_filter search *
microsoft_intune_device_health_scripts_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1072 Software Deployment Tools Execution
T1021.007 Cloud Services Lateral Movement
T1202 Indirect Command Execution Lateral Movement
T1105 Ingress Tool Transfer Defense Evasion
Command and Control
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.

Known False Positives

Legitimate adminstrative usage of this functionality will trigger this detection.

Associated Analytic Story

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset Azure AD azure:monitor:activity
Integration ✅ Passing Dataset Azure AD azure:monitor:activity

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1