{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/intune-management-extension/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Intune Management Extension"],"_cs_severities":["medium"],"_cs_tags":["lolbin","windows","living-off-the-land"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAgentExecutor.exe is a component of the Microsoft Intune Management Extension used for executing remediation and management scripts. Security research indicates that this binary can be abused to launch PowerShell instances with the execution policy set to \u0026quot;Bypass\u0026quot; when specific parameters are provided, allowing for the execution of unauthorized scripts. This activity is normally associated with the parent process Microsoft.Management.Services.IntuneWindowsAgent.exe; executions originating from other parent processes or occurring with unexpected arguments should be considered suspicious.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized execution of PowerShell scripts on systems managed by Intune, potentially leading to privilege escalation, persistence, or code execution in the context of the management agent.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the detection rule below to identify non-standard usage of AgentExecutor.exe.\u003c/li\u003e\n\u003cli\u003eBaseline legitimate management script activity originating from the Microsoft.Management.Services.IntuneWindowsAgent.exe parent process to minimize false positives.\u003c/li\u003e\n\u003cli\u003eInvestigate any instance of AgentExecutor.exe spawned by processes other than the primary Intune agent.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T03:05:49Z","date_published":"2026-11-07T03:05:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-agentexecutor-abuse/","summary":"The Intune management utility AgentExecutor.exe can be leveraged as a living-off-the-land binary (LOLBIN) to execute arbitrary PowerShell scripts with bypassed execution policies.","title":"Microsoft Intune Management Extension: Potential AgentExecutor.exe abuse","url":"https://feed.craftedsignal.io/briefs/2026-11-agentexecutor-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - Intune Management Extension","version":"https://jsonfeed.org/version/1.1"}