Intune Management Extension included on Intune Managed Devices
Paths:
Acknowledgement:
Eleftherios Panos - @lefterispan
Detection:
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1
Usecase:Execute unsigned powershell scripts
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\temp\" 0 1
Usecase:Execute a provided EXE