Ransomware/Cobalt via Intune/GP

I was having a talk with a couple guys from the last security ops centre I worked and one of them is convinced that exploits and attacker methodologies exist within the Intune application/GP to drop Ransomware or Cobalt Strike. He asked me if i've seen this activity before from threat actors which, honestly I haven't

​

My original thoughts on this is that this would not be possible unless an account with permissions to modify GP/Intune was compromised already, but …

cobalt cybersecurity intune ransomware