Intune Management Extension included on Intune Managed Devices Located at: C:\Program Files (x86)\Microsoft Intune Management Extension\AgentExecutor.exe.
agentexecutoragentexecutorSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Spawns powershell.exe and executes a provided powershell script with ExecutionPolicy Bypass argument (Execute unsigned powershell scripts)
AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1If we place a binary named powershell.exe in the specified folder path, agentexecutor.exe will execute it successfully (Execute a provided EXE)
AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "{PATH_ABSOLUTE:folder}" 0 1agentexecutor is a Windows LOLBin. Intune Management Extension included on Intune Managed Devices Located at: C:\Program Files (x86)\Microsoft Intune Management Extension\AgentExecutor.exe.