adding intune dataset

dluxtron · dluxtron · commit 04f6017139eb · 2025-01-07T14:25:39.000+10:00
diff --git a/datasets/attack_techniques/T1072/intune/intune.log b/datasets/attack_techniques/T1072/intune/intune.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9b70aab1b4dd6d107c2d10da795d2af4d3732f22e8b9aa1fbafd2a6094735a6f
+size 3702
diff --git a/datasets/attack_techniques/T1072/intune/intune.yml b/datasets/attack_techniques/T1072/intune/intune.yml
@@ -0,0 +1,11 @@
+author: Dean Luxton
+id: 75a7e34c-73e2-4084-8c59-530cc763e941
+date: '2025-01-07'
+description: Performing the Death from Above attack moving laterally from Intune management console to an Intune managed device. 
+environment: Frothly Dev Azure Tenant
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1072/intune/intune.log
+sourcetypes:
+- azure:monitor:activity
+references:
+- https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:9b70aab1b4dd6d107c2d10da795d2af4d3732f22e8b9aa1fbafd2a6094735a6f`
	`3`	`+size 3702`