Intune enrollment from GhostCode post-compromise IP 5.230.71.51

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•2

Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.