CVE-2025-0309 Intune Company Portal Graph Token Bypass via ROPC Grant
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
YARA-L
