Name:Microsoft Intune Bulk Wipe id:c3f48aa9-878e-443f-8889-e42a11a9bea9 version:2 date:None author:Jake Enea status:production type:TTP Description:The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default).
It leverages Intune audit logs to identify when this action is triggered. This activity is significant beacuse the "wipe ManagedDevice" action factory resets devices connected to your Microsoft Intune tenant.
If confirmed malicious, an attacker can abuse this action to perform a large-scale data wiping attack against your managed endpoints. Data_source:
-Azure Monitor Activity
search:`azure_monitor_activity` operationName="wipe ManagedDevice" | rename identity as user resultType as result | fillnull | table _time action command dest user src vendor_account vendor_product change_type properties.Targets.*
| stats min(_time) as firstTime max(_time) as lastTime values(*) as * count by user
how_to_implement:The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest Intune audit logs via Azure EventHub.
To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
Deploy as an event-based detection rule for quick deployment.
Adjust the count threshold according to expected activity in your environment. known_false_positives:Legitimate adminstrative usage of the "wipe ManagedDevice" action might trigger this detection.
This action is typically used for offboarding endpoints or in response to a lost or stolen device. References: -https://www.lumos.com/blog/stryker-hack -https://www.covertswarm.com/post/swarm-intelligence-strykers-intune-wipe-proves-your-bcdr-plan-has-a-single-point-of-failure -https://www.wwt.com/blog/how-the-stryker-intune-wipe-incident-highlights-a-critical-gap-in-endpoint-control drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View sign-in activity +/-1 hour surrounding the detection for - "$user$"' search:'`azure_monitor_aad` category=SignInLogs properties.userPrincipalName="$user$"' earliest_offset:'1h' latest_offset:'1h' analytic_story:['Azure Active Directory Account Takeover']
