Detection rules › Panther

Panther rules: intune

Rule	Severity
Intune Create or Modify Client App	`medium`
Intune Device Not Compliant	`low`
Intune New Device Management Script	`medium`

Intune Create or Modify Client App

Severity: medium
Log types: MicrosoftIntune.AuditLogs
Tags: InTune
Reference: www.ibm.com
Source: github.com/panther-labs/panther-analysis

Microsoft Intune allows administrators to deploy applications to devices as a means of remote management and configuration. This functionality can be abused by adversaries to deploy malicious executables to devices, thereby allowing adversaries to pivot from compromised accounts to endpoints. This detection identifies the creation of or changes to apps that are deployed to devices.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1072` Software Deployment Tools
Stealth	`T1202` Indirect Command Execution
Lateral Movement	`T1021.007` Remote Services: Cloud Services `T1072` Software Deployment Tools

Telemetry coverage

Platform	Record / event type
Intune	Create MobileApp

Detection logic

from base64 import b64decode

ACTOR = OPERATION = ""


def rule(event):
    # pylint: disable=global-statement
    global OPERATION

    OPERATION = event.get("operationName", "")

    # Alert on creation or modification of mobile apps
    return OPERATION.lower() in ["create mobileapp", "patch mobileapp"]


def title(event):
    # pylint: disable=global-statement
    global ACTOR

    ACTOR = event.get("identity", "")

    if OPERATION.lower().startswith("create"):
        return f"Intune: [{ACTOR or '<N/A>'}] created a new Intune mobile app."

    return f"Intune: [{ACTOR or '<N/A>'}] modified an Intune mobile app"


def alert_context(event):

    context = {
        "Actor": event.get("identity", default="Unknown"),
        "Operation": event.get("operationName", default="Unknown"),
        "Deployed App(s)": event.deep_get("properties", "TargetDisplayNames", default="Unknown"),
    }

    # Intune allows administrators to write PowerShell scripts to verify an app is properly
    # installed. These scripts can be used for malicious purposes. If a new script is added,
    # it will be in a ModifiedProperty section for hte given app, and will be base64 encoded
    scripts = []
    targets = event.deep_get("properties", "Targets")
    for target in targets:
        for prop in target["ModifiedProperties"]:
            if "Collection.Rules.ScriptContent" in prop.get("Name") and prop.get("New"):
                scripts.append(b64decode(prop.get("New")).decode("utf8"))
    if scripts:
        context["Validation Script(s)"] = scripts

    return context

Rule specification

AnalysisType: rule
Filename: intune_create_modify_client_app.py
RuleID: "Intune.CreateModifyClientApp"
DisplayName: "Intune Create or Modify Client App"
Enabled: true
LogTypes:
  - MicrosoftIntune.AuditLogs
Tags:
  - InTune
Severity: Medium
Reports:
  MITRE ATT&CK:
    - "TA0002:T1072"
    - "TA0008:T1021.007"
    - "TA0005:T1202"
Description: Microsoft Intune allows administrators to deploy applications to devices as a means of remote management and configuration. This functionality can be abused by adversaries to deploy malicious executables to devices, thereby allowing adversaries to pivot from compromised accounts to endpoints. This detection identifies the creation of or changes to apps that are deployed to devices.
Runbook: Review the actions taken to determine if they are legitimate changes by an administrator. Microsoft does not provide the IP address of the actor or hashes of the deployed applications. The Targets field will contain information on the deployed application to include names and parameters. Note that it is also possible for administrators to configure a PowerShell script to confirm an app is installed. This can also be abused to execute malicious code. If a script is configured, it will be present in base64 encoded form in the ModifiedProperties field.
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://www.ibm.com/think/x-force/detecting-intune-lateral-movement

Stages and Predicates

Fires on MicrosoftIntune.AuditLogs events when the condition below holds.

Condition

operationName is one of create mobileapp, patch mobileapp (case-insensitive)

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`operationName`	in	`create mobileapp` transforms: `tolower` `patch mobileapp` transforms: `tolower`	`field:"operationName" kind:in`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`Actor`	`identity`
`Operation`	`operationName`
`Deployed App(s)`	`properties.TargetDisplayNames`

Response runbook

Review the actions taken to determine if they are legitimate changes by an administrator. Microsoft does not provide the IP address of the actor or hashes of the deployed applications. The Targets field will contain information on the deployed application to include names and parameters. Note that it is also possible for administrators to configure a PowerShell script to confirm an app is installed. This can also be abused to execute malicious code. If a script is configured, it will be present in base64 encoded form in the ModifiedProperties field.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "category": "AuditLogs",
  "correlationId": "217da327-3767-4813-8f5f-af03ef38562a",
  "identity": "testuser@test.com",
  "operationName": "Create MobileApp",
  "properties": {
    "ActivityDate": "4/11/2025 6:21:02 PM",
    "ActivityResultStatus": 1,
    "ActivityType": 0,
    "Actor": {
      "ActorType": 1,
      "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
      "ApplicationName": "Microsoft Intune portal extension",
      "IsDelegatedAdmin": false,
      "ObjectId": "3a4518e8-d287-47a1-967e-cfde068d12e9",
      "PartnerTenantId": "00000000-0000-0000-0000-000000000000",
      "UPN": "testuser@test.com",
      "UserPermissions": [
        "*"
      ]
    },
    "AdditionalDetails": "",
    "AuditEventId": "ead98102-798e-474c-a3ae-2483eac30532",
    "Category": 5,
    "TargetDisplayNames": [
      "yubikey-manager-qt-1.2.6-win64.exe"
    ],
    "TargetObjectIds": [
      "22a27bc3-334d-400b-b428-a05911dc29c4"
    ],
    "Targets": [
      {
        "ModifiedProperties": [
          {
            "Name": "InstallCommandLine",
            "New": "yubikey-manager-qt-1.2.6-win64.exe /D \"C:\\Program Files\\Yubico\\YubiKey Manager\" /S"
          },
          {
            "Name": "UninstallCommandLine",
            "New": "ykman-uninstall.exe /D \"C:\\Program Files\\Yubico\\YubiKey Manager\" /S"
          },
          {
            "Name": "ApplicableArchitectures",
            "New": "X64"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V8_0",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V8_1",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_0",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1607",
            "New": "True"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1703",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1709",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1803",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1809",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1903",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_1909",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_2004",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_2H20",
            "New": "False"
          },
          {
            "Name": "MinimumSupportedOperatingSystem.V10_21H1",
            "New": "False"
          },
          {
            "Name": "MinimumFreeDiskSpaceInMB",
            "New": "<null>"
          },
          {
            "Name": "MinimumMemoryInMB",
            "New": "<null>"
          },
          {
            "Name": "MinimumNumberOfProcessors",
            "New": "<null>"
          },
          {
            "Name": "MinimumCpuSpeedInMHz",
            "New": "<null>"
          },
          {
            "Name": "InstallExperience.RunAsAccount",
            "New": "System"
          },
          {
            "Name": "InstallExperience.MaxRunTimeInMinutes",
            "New": "60"
          },
          {
            "Name": "InstallExperience.DeviceRestartBehavior",
            "New": "Allow"
          },
          {
            "Name": "SetupFilePath",
            "New": "yubikey-manager-qt-1.2.6-win64.exe"
          },
          {
            "Name": "MinimumSupportedWindowsRelease",
            "New": "1607"
          },
          {
            "Name": "DisplayVersion",
            "New": ""
          },
          {
            "Name": "AllowAvailableUninstall",
            "New": "True"
          },
          {
            "Name": "CommittedContentVersion",
            "New": "<null>"
          },
          {
            "Name": "FileName",
            "New": "yubikey-manager-qt-1.2.6-win64.intunewin"
          },
          {
            "Name": "Size",
            "New": "0"
          },
          {
            "Name": "Id",
            "New": "22a27bc3-334d-400b-b428-a05911dc29c4"
          },
          {
            "Name": "Description",
            "New": "yubikey-manager-qt-1.2.6-win64.exe"
          },
          {
            "Name": "Publisher",
            "New": "YubiCo"
          },
          {
            "Name": "CreatedDateTime",
            "New": "4/11/2025 6:21:02 PM"
          },
          {
            "Name": "LastModifiedDateTime",
            "New": "4/11/2025 6:21:02 PM"
          },
          {
            "Name": "IsFeatured",
            "New": "False"
          },
          {
            "Name": "PrivacyInformationUrl",
            "New": ""
          },
          {
            "Name": "InformationUrl",
            "New": "<null>"
          },
          {
            "Name": "Owner",
            "New": ""
          },
          {
            "Name": "Developer",
            "New": ""
          },
          {
            "Name": "Notes",
            "New": ""
          },
          {
            "Name": "UploadState",
            "New": "0"
          },
          {
            "Name": "PublishingState",
            "New": "NotPublished"
          },
          {
            "Name": "IsAssigned",
            "New": "False"
          },
          {
            "Name": "DependentAppCount",
            "New": "0"
          },
          {
            "Name": "SupersedingAppCount",
            "New": "0"
          },
          {
            "Name": "SupersededAppCount",
            "New": "0"
          },
          {
            "Name": "DeviceManagementAPIVersion",
            "New": "5025-01-29"
          },
          {
            "Name": "$Collection.DetectionRules.Check32BitOn64System[0]",
            "New": "False"
          },
          {
            "Name": "$Collection.DetectionRules.DetectionType[0]",
            "New": "Exists"
          },
          {
            "Name": "$Collection.DetectionRules.DetectionValue[0]",
            "New": "<null>"
          },
          {
            "Name": "$Collection.DetectionRules.FileOrFolderName[0]",
            "New": "ykman-gui.exe"
          },
          {
            "Name": "$Collection.DetectionRules.Operator[0]",
            "New": "NotConfigured"
          },
          {
            "Name": "$Collection.DetectionRules.Path[0]",
            "New": "C:\\Program Files\\Yubico\\YubiKey Manager"
          },
          {
            "Name": "$Collection.ReturnCodes.ReturnCode[0]",
            "New": "0"
          },
          {
            "Name": "$Collection.ReturnCodes.ReturnCode[1]",
            "New": "1707"
          },
          {
            "Name": "$Collection.ReturnCodes.ReturnCode[2]",
            "New": "3010"
          },
          {
            "Name": "$Collection.ReturnCodes.ReturnCode[3]",
            "New": "1641"
          },
          {
            "Name": "$Collection.ReturnCodes.ReturnCode[4]",
            "New": "1618"
          },
          {
            "Name": "$Collection.ReturnCodes.Type[0]",
            "New": "Success"
          },
          {
            "Name": "$Collection.ReturnCodes.Type[1]",
            "New": "Success"
          },
          {
            "Name": "$Collection.ReturnCodes.Type[2]",
            "New": "SoftReboot"
          },
          {
            "Name": "$Collection.ReturnCodes.Type[3]",
            "New": "HardReboot"
          },
          {
            "Name": "$Collection.ReturnCodes.Type[4]",
            "New": "Retry"
          },
          {
            "Name": "$Collection.Rules.Check32BitOn64System[0]",
            "New": "False"
          },
          {
            "Name": "$Collection.Rules.ComparisonValue[0]",
            "New": "<null>"
          },
          {
            "Name": "$Collection.Rules.FileOrFolderName[0]",
            "New": "ykman-gui.exe"
          },
          {
            "Name": "$Collection.Rules.OperationType[0]",
            "New": "Exists"
          },
          {
            "Name": "$Collection.Rules.Operator[0]",
            "New": "NotConfigured"
          },
          {
            "Name": "$Collection.Rules.Path[0]",
            "New": "C:\\Program Files\\Yubico\\YubiKey Manager"
          },
          {
            "Name": "$Collection.Rules.RuleType[0]",
            "New": "Detection"
          }
        ],
        "Name": "yubikey-manager-qt-1.2.6-win64.exe"
      }
    ]
  },
  "resultDescription": "None",
  "resultType": "Success",
  "tenantId": "11111111-2222-3333-44444-555555555555",
  "time": "2025-04-11:21:02.3387000Z"
}

Intune Device Not Compliant

Severity: low
Log types: MicrosoftIntune.OperationalLogs
Tags: InTune
Reference: learn.microsoft.com
Source: github.com/panther-labs/panther-analysis

Microsoft Intune allows administrators to manage devices and enforce compliance with established policies. This detection identifies devices that are not compliant with the established policies.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1652` Device Driver Discovery

Detection logic

HOSTNAME = ""


def rule(event):

    return all(
        [
            event.get("operationName", "").lower() == "compliance",
            event.deep_get("properties", "AlertType", default="").lower()
            == "managed device not compliant",
        ]
    )


def title(event):
    # pylint: disable=global-statement
    global HOSTNAME

    # Simple title with hostname of the non-compliant device
    HOSTNAME = event.deep_get("properties", "DeviceHostName", default="Unknown")

    return f"INTUNE: [{HOSTNAME}] reported as non-compliant"


def alert_context(event):
    return {
        "Hostname": HOSTNAME,
        "Operating System": event.deep_get(
            "properties", "DeviceOperatingSystem", default="Unknown"
        ),
        "User": event.deep_get("properties", "UserName", default="Unknown"),
        "User Display Name": event.deep_get("properties", "UserDisplayName", default="Unknown"),
        "Description": event.deep_get("properties", "Description", default="Unknown"),
    }

Rule specification

AnalysisType: rule
Filename: intune_device_not_compliant.py
RuleID: "Intune.DeviceNotCompliant"
DisplayName: "Intune Device Not Compliant"
Enabled: true
LogTypes:
    - MicrosoftIntune.OperationalLogs
Tags:
    - InTune
Severity: Low
Reports:
    MITRE ATT&CK:
        - "TA0005:T1652"
Description: Microsoft Intune allows administrators to manage devices and enforce compliance with established policies. This detection identifies devices that are not compliant with the established policies.
Runbook: Review the Description field for information about the policy that the device is not compliant with. This is typically easier to review and investigate in the Intune portal.
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://learn.microsoft.com/en-us/intune/intune-service/protect/compliance-policy-monitor

Stages and Predicates

Fires on MicrosoftIntune.OperationalLogs events when all of the conditions below hold.

Condition

operationName is compliance (case-insensitive)
properties.AlertType is managed device not compliant (case-insensitive)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`operationName`	eq	`compliance` transforms: `tolower`	`field:"operationName" kind:eq value:"compliance"`
`properties.AlertType`	eq	`managed device not compliant` transforms: `tolower`	`field:"properties.AlertType" kind:eq value:"managed device not compliant"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`Operating System`	`properties.DeviceOperatingSystem`
`User`	`properties.UserName`
`User Display Name`	`properties.UserDisplayName`
`Description`	`properties.Description`
`DeviceHostName`	`properties.DeviceHostName`

Response runbook

Review the Description field for information about the policy that the device is not compliant with. This is typically easier to review and investigate in the Intune portal.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "category": "OperationalLogs",
  "operationName": "Compliance",
  "properties": {
    "AADTenantId": "11111111-2222-3333-4444-555555555555",
    "AlertDisplayName": "Managed Device TestDevice_8/2/2024_6:32 PM is not Compliant",
    "AlertType": "Managed Device Not Compliant",
    "Description": "DefaultDeviceCompliancePolicy.RequireRemainContact||DefaultDeviceCompliancePolicy.RequireRemainContact||DefaultDeviceCompliancePolicy.RequireRemainContact||Expected recent contact. Last contact: 2025-03-27 17:35:40Z||2025-03-27 17:35:40Z||ComplianceCalculation",
    "DeviceDnsDomain": "",
    "DeviceHostName": "TestDevice",
    "DeviceName": "TestDevice_8/2/2024_6:32 PM",
    "DeviceNetBiosName": "TestDevice",
    "DeviceOperatingSystem": "Windows 10.0.26100.2894",
    "IntuneAccountId": "11111111-2222-3333-4444-555555555555",
    "IntuneDeviceId": "11111111-2222-3333-4444-555555555555",
    "IntuneUserId": "11111111-2222-3333-4444-555555555555",
    "OperationalLogCategory": "DeviceCompliance",
    "ScaleUnit": "AMSUA0602",
    "ScenarioName": "Microsoft.Management.Services.Diagnostics.SLAEvents.DeviceNotInComplianceSecurityAlert",
    "StartTimeUtc": "2025-04-02T05:57:59.4097Z",
    "UPNSuffix": "test.com",
    "UserDisplayName": "Device Enrollment Manager",
    "UserName": "testuser"
  },
  "resultType": "None",
  "tenantId": "11111111-2222-3333-4444-555555555555",
  "time": "2025-04-02T05:57:59.4097000Z"
}

Intune New Device Management Script

Severity: medium
Log types: MicrosoftIntune.AuditLogs
Tags: InTune
Reference: cloud.google.com
Source: github.com/panther-labs/panther-analysis

Microsoft Intune allows administrators to deploy scripts to devices as a means of remote management and configuration. These scripts, which can be executed by the local SYSTEM account, provides a powerful capability to managed devices. This functionality can be abused by adversaries to deploy malicious scripts to devices, thereby allowing adversaries to pivot from compromised accounts to endpoints. This detection identifies changes to device management scripts, to include creation, modification, and deletion of scripts.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1072` Software Deployment Tools
Stealth	`T1202` Indirect Command Execution
Lateral Movement	`T1021.007` Remote Services: Cloud Services `T1072` Software Deployment Tools

Detection logic

ACTOR = OPERATION = ""


def rule(event):
    # pylint: disable=global-statement
    global OPERATION

    # Alert on DeviceManagementScript or DeviceHealthScript events
    OPERATION = event.get("operationName")
    return ("DeviceManagementScript" in OPERATION) or ("DeviceComplianceScript" in OPERATION)


def title(event):
    # pylint: disable=global-statement
    global ACTOR

    ACTOR = event.get("identity", "")

    # Return a generic title if the operation is unknown
    if OPERATION == "Unknown":
        return f"A change to InTune device management scripts was performed by [{ACTOR}]."

    # The script type is the second word in the operation
    script_type_parts = OPERATION.split(" ")
    if len(script_type_parts) > 1:
        script_type = script_type_parts[1]
    else:
        script_type = "Unknown"

    if OPERATION.startswith("create"):
        action = "created"
    elif OPERATION.startswith("assign"):
        action = "assigned"
    elif OPERATION.startswith("delete"):
        action = "deleted"
    elif OPERATION.startswith("patched"):
        action = "patched"
    else:
        action = "unknown"

    return f"An InTune device [{script_type}] script was [{action}] by [{ACTOR}]"


def alert_context(event):
    return {
        "Actor": ACTOR,
        "Operation": OPERATION,
        "Object IDs": event.deep_get("properties", "TargetObjectIds", default="Unknown"),
    }

Rule specification

AnalysisType: rule
Filename: intune_new_device_management_script.py
RuleID: "Intune.NewDeviceManagementScript"
DisplayName: "Intune New Device Management Script"
Enabled: true
LogTypes:
    - MicrosoftIntune.AuditLogs
Tags:
    - InTune
Severity: Medium
Reports:
    MITRE ATT&CK:
        - "TA0002:T1072"
        - "TA0008:T1021.007"
        - "TA0005:T1202"
Description: Microsoft Intune allows administrators to deploy scripts to devices as a means of remote management and configuration. These scripts, which can be executed by the local SYSTEM account, provides a powerful capability to managed devices. This functionality can be abused by adversaries to deploy malicious scripts to devices, thereby allowing adversaries to pivot from compromised accounts to endpoints. This detection identifies changes to device management scripts, to include creation, modification, and deletion of scripts.
Runbook: Review the actions taken to determine if they are legitimate changes by an administrator. Microsoft does not provide the IP address of the actor or the name of the affected scripts, but more information can be found by navigating to the Intune portal and reviewing the configured scripts. The TargetObjectIds field specifies the ID of the script(s) that were targeted by the given action.  The TargetGroupIDs specify target groups of devices that the script will be assigned to. If the actor deletes a script, it will not be possible to retrieve more information from the portal. Endpoint investigation can be performed by reviewing InTune logs at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\_IntuneManagementExtension.txt on affected endpoints.
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://cloud.google.com/blog/topics/threat-intelligence/abusing-intune-permissions-entra-id-environments

Stages and Predicates

Fires on MicrosoftIntune.AuditLogs events when any of the conditions below holds.

Condition

any of:
- operationName contains DeviceManagementScript
- operationName contains DeviceComplianceScript

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`operationName`	contains	`DeviceComplianceScript` `DeviceManagementScript`	`field:"operationName" kind:contains`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`Object IDs`	`properties.TargetObjectIds`
`identity`

Response runbook

Review the actions taken to determine if they are legitimate changes by an administrator. Microsoft does not provide the IP address of the actor or the name of the affected scripts, but more information can be found by navigating to the Intune portal and reviewing the configured scripts. The TargetObjectIds field specifies the ID of the script(s) that were targeted by the given action. The TargetGroupIDs specify target groups of devices that the script will be assigned to. If the actor deletes a script, it will not be possible to retrieve more information from the portal. Endpoint investigation can be performed by reviewing InTune logs at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs_IntuneManagementExtension.txt on affected endpoints.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "category": "AuditLogs",
  "correlationId": "74631aa2-a9ea-4b5d-8d48-3e008d092325",
  "identity": "testuser@testdomain.com",
  "operationName": "assignDeviceManagementScript DeviceManagementScript",
  "properties": {
    "ActivityDate": "4/1/2025 6:42:09 PM",
    "ActivityResultStatus": 1,
    "ActivityType": 3,
    "Actor": {
      "ActorType": 1,
      "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
      "ApplicationName": "Microsoft Intune portal extension",
      "IsDelegatedAdmin": false,
      "ObjectId": "5774e54b-f2ad-41f8-a2d5-4bc356342fa6",
      "PartnerTenantId": "00000000-0000-0000-0000-000000000000",
      "UPN": "testuser@testdomain.com",
      "UserPermissions": [
        "*"
      ]
    },
    "AdditionalDetails": "Key = TargetGroupIDsValue = 36ca05af-f92e-48b6-8f7a-5bf3924a4926\r\nKey = TargetGroupIDsValue = 36ca05af-f92e-48b6-8f7a-5bf3924a4926\r\n",
    "AuditEventId": "88abb00c-2752-4c2f-b690-00c6c4f2931b",
    "Category": 3,
    "TargetDisplayNames": [
      "<null>"
    ],
    "TargetObjectIds": [
      "914232cd-e64b-4ecd-9fe2-ecfc5f1aef89"
    ],
    "Targets": [
      {
        "ModifiedProperties": [
          {
            "Name": "TargetGroupIDs",
            "New": "36ca05af-f92e-48b6-8f7a-5bf3924a4926"
          },
          {
            "Name": "DeviceManagementAPIVersion",
            "New": "5025-02-18"
          }
        ]
      }
    ]
  },
  "resultDescription": "None",
  "resultType": "Success",
  "tenantId": "11111111-2222-3333-4444-555555555555",
  "time": "2025-04-01T18:42:09.5769000Z"
}