M365/Audit: Successful Intune Company Portal login tied to Cmsi request

title: "M365/Audit: Successful Intune Company Portal login tied to Cmsi request"
id: d31b7e61-d420-4176-b38a-56c9842b24ce
status: experimental
description: This rule flags successful sign-ins to the Microsoft Intune Company Portal using the Cmsi request type. Attackers may use this kind of authentication flow to attempt bypassing Conditional Access and Intune device trust checks. Detection relies on M365 audit events for UserLoggedIn with the specified ApplicationId, ResultStatus, and RequestType, excluding events with the known Intune-enrollment ObjectId.
author: Josh Nickels, Marius Rothenbücher, Huntrule Team
references:
  - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
  - https://github.com/JumpsecLabs/TokenSmith
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml
date: 2025-01-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  service: audit
  product: m365
detection:
  selection:
    Operation: UserLoggedIn
    ApplicationId: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223
    ResultStatus: Success
    RequestType: Cmsi:Cmsi
  filter_main_bjectid:
    ObjectId: 0000000a-0000-0000-c000-000000000000
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
    type: derived