New Intune PowerShell Or Shell Script Created
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Microsoft Sentinel (KQL)
