Detection: Microsoft Intune Mobile Apps

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2025-01-07 ID: 98e6b389-2806-4426-a580-8a92cb0d9710 Author: Dean Luxton Type: Hunting Product: Splunk Enterprise Security

Description

Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices. This detection identifies when a new packaged application has been added, updated or deleted.

1`azure_monitor_activity` operationName="*MobileApp*"  
2| rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin 
3| rex field="operationName" "^(?P<action>\w+)\s" 
4| replace "Patch" with "updated", "Create" with "created", "Delete", with "deleted", "assign", with "assigned" IN action 
5| table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId 
6| `microsoft_intune_mobile_apps_filter`

Data Source

Name Platform Sourcetype Source
Azure Monitor Activity Azure icon Azure 'azure:monitor:activity' 'Azure AD'

Macros Used

Name Value
azure_monitor_activity sourcetype=azure:monitor:activity
microsoft_intune_mobile_apps_filter search *
microsoft_intune_mobile_apps_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1072 Software Deployment Tools Execution
T1021.007 Cloud Services Lateral Movement
T1202 Indirect Command Execution Lateral Movement
T1105 Ingress Tool Transfer Defense Evasion
Command and Control
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.

Known False Positives

Legitimate adminstrative usage of this functionality will trigger this detection.

Associated Analytic Story

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit ✅ Passing Dataset Azure AD azure:monitor:activity
Integration ✅ Passing Dataset Azure AD azure:monitor:activity

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1