Microsoft Intune Management Extension: Potential AgentExecutor.exe abuse

AgentExecutor.exe is a component of the Microsoft Intune Management Extension used for executing remediation and management scripts. Security research indicates that this binary can be abused to launch PowerShell instances with the execution policy set to "Bypass" when specific parameters are provided, allowing for the execution of unauthorized scripts. This activity is normally associated with the parent process Microsoft.Management.Services.IntuneWindowsAgent.exe; executions originating from other parent processes or occurring with unexpected arguments should be considered suspicious.

Impact

Unauthorized execution of PowerShell scripts on systems managed by Intune, potentially leading to privilege escalation, persistence, or code execution in the context of the management agent.

Recommendation

• Deploy the detection rule below to identify non-standard usage of AgentExecutor.exe.
• Baseline legitimate management script activity originating from the Microsoft.Management.Services.IntuneWindowsAgent.exe parent process to minimize false positives.
• Investigate any instance of AgentExecutor.exe spawned by processes other than the primary Intune agent.