Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

MediumSplunk security contentThreat hunting

Microsoft Intune DeviceManagementConfigurationPolicies

Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. This functionality can also be abused to disable defences & evade detection. This detection identifies when a new device management configuration policy has been created.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: azure_monitor_activity

What the source says

What fires this without an attack behind it

Legitimate adminstrative usage of this functionality will trigger this detection.

References

Tagged by the source as

Azure Active Directory Account TakeoverAzure TenantcloudSplunk CloudSplunk EnterpriseSplunk Enterprise Securityaudit

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.