Bypass Intune Conditional Access Using TokenSmith: Detection & Response

ONE SENTENCE SUMMARY: Blackhat EU 2024 showcased TEMP43487580’s impactful exploit of Microsoft’s Intune Conditional Access Policies, with detection insights and mitigation strategies.
MAIN POINTS:
TEMP43487580 presented a method to bypass Conditional Access Policies in Microsoft Intune.
Dirk-Jan confirmed the exploit, stating “the cat is now out of the bag.”
Attackers can exploit Microsoft Intune’s Conditional Access Policies using TokenSmith.
The exploit targets non-compliant devices to gain access through the Company Portal.
A robust detection mechanism was developed using Microsoft Defender XDR queries.
Suspicious activities included logins from non-compliant devices and failed CAP policies.
Immediate SOC action includes revoking sessions and enforcing password resets.
No current prevention options exist, but Microsoft is expected to respond.
Collaboration among detection teams is vital for understanding exploit abuse.
The community is encouraged to implement shared detection queries for improved security.
TAKEAWAYS:
Understanding exploit methods is crucial for preemptive security measures.
Detection mechanisms can be streamlined through advanced query use.
Prompt SOC actions are essential after exploit detection.
Community collaboration enhances the development of prevention strategies.
Continuous monitoring for post-exploitation activities is vital for security.