Corp MDM USSD-based unconditional call-forwarding activation/cancellation
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Microsoft Sentinel (KQL)

