Intune Agent Spawning Shell
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Microsoft Sentinel (KQL)
