Getting "In Tune” with an Enterprise: Detecting Microsoft Intune Lateral Movement

No ratings

Presented at Bluehat / BlueHat India 2024 by

Brett Hawkins

Organizations continue to implement cloud-based services, a shift which has led to the wider adoption of hybrid identity environments that connect on-premises Active Directory with Microsoft Entra ID (formerly Azure AD), To manage devices in these hybrid identity environments, Microsoft Intune has emerged as one of the most popular device management solutions. Since this trusted enterprise platform can easily be integrated with on-premises Active Directory devices and services, it is a prime target for attackers to abuse for conducting lateral movement and code execution. This research will give a background on Microsoft Intune (Intune) and how it is being used within organizations. It will then show how to use this cloud-based platform to deploy custom Windows applications to achieve code execution on user devices. Additionally, this research includes the public release of new Microsoft Sentinel rules to help defenders detect the usage of Intune for lateral movement and defensive hardening guidance for the Intune platform.