Detection: Microsoft Intune Device Health Scripts

Updated Date: 2025-01-06 ID: 6fe42e07-15b1-4caa-b547-7885666cb1bd Author: Dean Luxton Type: Hunting Product: Splunk Enterprise Security

Description

Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection identifies when a new device health script has been added, updated or deleted.

1`azure_monitor_activity` operationName="*DeviceHealthScript*"  
2| rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin 
3| rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" 
4| replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action 
5| table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId 
6| `microsoft_intune_device_health_scripts_filter`

Data Source

Name Platform Sourcetype Source
Azure Monitor Activity Azure icon Azure 'azure:monitor:activity' 'Azure AD'

Macros Used

Name Value
azure_monitor_activity sourcetype=azure:monitor:activity
microsoft_intune_device_health_scripts_filter search *
microsoft_intune_device_health_scripts_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1072 Software Deployment Tools Execution
T1021.007 Cloud Services Lateral Movement
T1202 Indirect Command Execution Lateral Movement
T1105 Ingress Tool Transfer Defense Evasion
Command and Control
Exploitation
Installation
DE.AE
CIS 10
APT32
Sandworm Team
Silence
Threat Group-1314
APT29
Scattered Spider
Lazarus Group
RedCurl
APT-C-36
APT18
APT28
APT29
APT3
APT32
APT33
APT37
APT38
APT39
APT41
Ajax Security Team
Andariel
Aquatic Panda
BITTER
BRONZE BUTLER
BackdoorDiplomacy
Chimera
Cinnamon Tempest
Cobalt Group
Confucius
Daggerfly
Darkhotel
Dragonfly
Elderwood
Evilnum
FIN13
FIN7
FIN8
Fox Kitten
GALLIUM
Gamaredon Group
Gorgon Group
HAFNIUM
HEXANE
INC Ransom
IndigoZebra
Indrik Spider
Ke3chang
Kimsuky
Lazarus Group
LazyScripter
Leviathan
LuminousMoth
Magic Hound
Metador
Molerats
Moonstone Sleet
Moses Staff
MuddyWater
Mustang Panda
Mustard Tempest
Nomadic Octopus
OilRig
PLATINUM
Patchwork
Play
Rancor
Rocke
Sandworm Team
SideCopy
Sidewinder
Silence
TA2541
TA505
TA551
TeamTNT
Threat Group-3390
Tonto Team
Tropic Trooper
Turla
Volatile Cedar
Volt Typhoon
WIRTE
Whitefly
Windshift
Winnti Group
Winter Vivern
Wizard Spider
ZIRCONIUM
menuPass

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.

Known False Positives

Legitimate adminstrative usage of this functionality will trigger this detection.

Associated Analytic Story

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset Azure AD azure:monitor:activity
Integration ✅ Passing Dataset Azure AD azure:monitor:activity

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1