Intune-Device

Event	Sample	Rule
Device (catch-all)	N	N
Patch ManagedDevice	Y	N
syncDevice ManagedDevice	Y	N
wipe ManagedDevice	N	Y
retire ManagedDevice	N	N
remoteLock ManagedDevice	N	N
Create DeviceHealthScript	N	Y
Delete DeviceHealthScript	N	Y
Patch DeviceHealthScript	N	Y

any: Device (catch-all)

Description

Synthetic aggregation for Intune audit rules that filter the Device category without a specific activityType. Not a distinct audit record.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Patch ManagedDevice

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "f6df3626-ae83-4fa1-9cb4-99d77e00bef9",
  "displayName": "Patch ManagedDevice",
  "componentName": "ManagedDevices",
  "activity": null,
  "activityDateTime": "2026-07-04T21:01:01.7224556Z",
  "activityType": "Patch ManagedDevice",
  "activityOperationType": "Patch",
  "activityResult": "Success",
  "correlationId": "16fa3578-ee42-4c97-afe5-bf7970fe60e2",
  "category": "Device",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "<null>",
      "auditResourceType": "ManagedDevice",
      "resourceId": "9cd8d483-9ed2-4326-85a5-09712053920d",
      "modifiedProperties": [
        {
          "displayName": "Notes",
          "oldValue": "<null>",
          "newValue": "detection.wiki harness capture"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2025-07-09"
        }
      ]
    }
  ]
}

syncDevice ManagedDevice

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "f579fd21-14f0-42a8-8e24-ffb1e3f7dbeb",
  "displayName": "syncDevice ManagedDevice",
  "componentName": "ManagedDevices",
  "activity": null,
  "activityDateTime": "2026-07-04T21:00:12.2928567Z",
  "activityType": "syncDevice ManagedDevice",
  "activityOperationType": "Action",
  "activityResult": "Success",
  "correlationId": "76614219-9718-4ac3-814a-b066be3d315f",
  "category": "Device",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "syncDevice",
      "auditResourceType": "Microsoft.Management.Services.Api.ManagedDevice",
      "resourceId": "9cd8d483-9ed2-4326-85a5-09712053920d",
      "modifiedProperties": [
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2025-07-09"
        }
      ]
    }
  ]
}

wipe ManagedDevice

Description

Generic 'wipe ManagedDevice' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`count` (splunk rule field)	ge	`5`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune Bulk Wipe source: The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default). It leverages Intune audit logs to identify when this action is triggered. This activity is significant…T1561, T1561.001

retire ManagedDevice

Description

Generic 'retire ManagedDevice' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

remoteLock ManagedDevice

Description

Generic 'remoteLock ManagedDevice' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Create DeviceHealthScript

Description

Generic 'Create DeviceHealthScript' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune Device Health Scripts source: Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection…T1021, T1021.007, T1072, T1105, T1202↳ also matches Delete DeviceHealthScript, Patch DeviceHealthScript

Delete DeviceHealthScript

Description

Generic 'Delete DeviceHealthScript' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune Device Health Scripts source: Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection…T1021, T1021.007, T1072, T1105, T1202↳ also matches Create DeviceHealthScript, Patch DeviceHealthScript

Patch DeviceHealthScript

Description

Generic 'Patch DeviceHealthScript' activityOperationType recorded in the Intune Device audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('Device').

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune Device Health Scripts source: Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection…T1021, T1021.007, T1072, T1105, T1202↳ also matches Create DeviceHealthScript, Delete DeviceHealthScript

Intune-Device

any: Device (catch-all)

Description

Fields #

Patch ManagedDevice

Fields #

Example Audit Record #

syncDevice ManagedDevice

Fields #

Example Audit Record #

wipe ManagedDevice

Description

Fields #

Common Indicators #

Detection Rules #

Splunk #

retire ManagedDevice

Description

Fields #

remoteLock ManagedDevice

Description

Fields #

Create DeviceHealthScript

Description

Fields #

Detection Rules #

Splunk #

Delete DeviceHealthScript

Description

Fields #

Detection Rules #

Splunk #

Patch DeviceHealthScript

Description

Fields #

Detection Rules #

Splunk #

References #