All Detections

Unauthorized Intune Script Creation

avatar
Ankit Mehta@Secvyn
updated Jun 30, 2026109

Detects creation of Intune device management scripts, a potential privilege abuse vector.

Microsoft Sentinel (KQL)