.. / AgentExecutor.exe
Star

Intune Management Extension included on Intune Managed Devices


Paths:


Resources:


Acknowledgement:
Eleftherios Panos - @lefterispan


Detection:



Execute

Spawns powershell.exe and executes a provided powershell script with ExecutionPolicy Bypass argument 
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1
Usecase:Execute unsigned powershell scripts
Privileges required:User
OS:Windows 10
Mitre:T1218



If we place a binary named powershell.exe in the path c:\temp, agentexecutor.exe will execute it successfully 
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\temp\" 0 1
Usecase:Execute a provided EXE
Privileges required:User
OS:Windows 10
Mitre:T1218