Intune Agent Spawning Shell
Detects the Intune Management Extension agent spawning command interpreters. Because Intune executes scripts as SYSTEM, monitoring the resulting behavior on the endpoint is critical for identifying malicious script deployments.
Microsoft Sentinel (KQL)
