Intune Management Extension - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/intune-management-extension/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 03:05:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft Intune Management Extension: Potential AgentExecutor.exe abusehttps://feed.craftedsignal.io/briefs/2026-11-agentexecutor-abuse/Sat, 07 Nov 2026 03:05:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-agentexecutor-abuse/The Intune management utility AgentExecutor.exe can be leveraged as a living-off-the-land binary (LOLBIN) to execute arbitrary PowerShell scripts with bypassed execution policies.AgentExecutor.exe is a component of the Microsoft Intune Management Extension used for executing remediation and management scripts. Security research indicates that this binary can be abused to launch PowerShell instances with the execution policy set to "Bypass" when specific parameters are provided, allowing for the execution of unauthorized scripts. This activity is normally associated with the parent process Microsoft.Management.Services.IntuneWindowsAgent.exe; executions originating from other parent processes or occurring with unexpected arguments should be considered suspicious.

Impact

Unauthorized execution of PowerShell scripts on systems managed by Intune, potentially leading to privilege escalation, persistence, or code execution in the context of the management agent.

Recommendation

  • Deploy the detection rule below to identify non-standard usage of AgentExecutor.exe.
  • Baseline legitimate management script activity originating from the Microsoft.Management.Services.IntuneWindowsAgent.exe parent process to minimize false positives.
  • Investigate any instance of AgentExecutor.exe spawned by processes other than the primary Intune agent.
]]>mediumadvisorylolbinwindowsliving-off-the-land