Microsoft Intune Mobile Application Activity

This detection identifies when a new packaged application has been added, updated, or deleted within Microsoft Intune. This functionality, while legitimate for software deployment, can be abused by adversaries to deploy malicious payloads to Intune-managed devices.