Merge pull request splunk#1150 from jakeenea51/bulk_wipe

ljstella · web-flow · commit c81e500efc52 · 2026-03-30T14:37:53.000-05:00
Dataset: T1561.001 - Microsoft Intune Bulk Wipe
diff --git a/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a1ceda0afc580ecf7e761e44aa109e9b1f1d52e529e9c4fe72ad2d950512c227
+size 13001
diff --git a/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.yml b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.yml
@@ -0,0 +1,13 @@
+author: Jake Enea
+id: 4a5c3288-8391-4e80-9c3d-9dbb60ed1c45
+date: '2026-03-29'
+description: The following data contains simulated bulk Intune "wipe ManagedDevice" events from the Intune admin portal. 
+environment: attack_range
+directory: microsoft_intune_bulk_wipe
+mitre_technique:
+- T1561.001
+datasets:
+- name: microsoft_intune_bulk_wipe
+  path: /datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log
+  sourcetype: azure:monitor:activity
+  source: not_applicable

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:a1ceda0afc580ecf7e761e44aa109e9b1f1d52e529e9c4fe72ad2d950512c227`
	`3`	`+size 13001`