KQL Search

id: 5a6f1c3e-2a1b-4c9e-9f01-11a2b3c4d513
name: Intune - Jailbroken or rooted device accessing corporate resources
description: |
  Identifies devices reported by Intune as jailbroken (iOS) or rooted (Android) — either directly
  via the JailBroken field or via compliance states indicating such. These devices have had their
  security model broken and should not be allowed to hold corporate tokens.
severity: High
requiredDataConnectors:
  - connectorId: AzureMonitor(IntuneLogs)
    dataTypes:
      - IntuneDevices
      - IntuneDeviceComplianceOrg
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
  - DefenseEvasion
relevantTechniques:
  - T1078
  - T1562
query: |
  // Mobile-only: jailbreak/root signals are meaningful only on iOS/iPadOS/Android.
  // Windows/macOS/Linux endpoints can report Jail="Unknown" and would otherwise
  // generate false positives, so they are filtered out in both branches with an
  // explicit allow-list AND an explicit deny-list (belt-and-suspenders).
  let MobileOS = dynamic(["iOS","iPadOS","Android"]);
  let DesktopOS = dynamic(["Windows","macOS","Mac OS","Linux"]);
  let risky =
      IntuneDevices
      | where TimeGenerated > ago(1d)
      | extend Jail = tostring(column_ifexists("JailBroken", ""))
      | where Jail =~ "True" or Jail =~ "Yes" or Jail =~ "Unknown"
      | extend OS = tostring(OS)
      | where OS has_any (MobileOS) and not(OS has_any (DesktopOS))
      // Drop the noisy "Unknown" status unless we have a confirmed mobile OS string
      | where Jail !~ "Unknown" or OS in~ ("iOS","iPadOS","Android")
      | summarize arg_max(TimeGenerated, *) by DeviceId = tostring(DeviceId)
      | project DeviceId, DeviceName = tostring(DeviceName),
                UPN = tolower(tostring(UPN)), OS,
                OSVersion = tostring(OSVersion), Jail;
  let compRisky =
      IntuneDeviceComplianceOrg
      | where TimeGenerated > ago(1d)
      | where ComplianceState in~ ("Jailbroken","Rooted")
      | extend OS = tostring(OSDescription)
      | where OS has_any (MobileOS) and not(OS has_any (DesktopOS))
      | summarize arg_max(TimeGenerated, *) by DeviceId = tostring(DeviceId)
      | project DeviceId, DeviceName = tostring(DeviceName),
                UPN = tolower(tostring(column_ifexists("UPN", column_ifexists("UserPrincipalName", "")))),
                OS, OSVersion = "",
                Jail = ComplianceState;
  union isfuzzy=true risky, compRisky
  | where OS has_any (MobileOS) and not(OS has_any (DesktopOS))
  | summarize arg_max(DeviceName, *) by DeviceId
  | extend AccountCustomEntity = UPN, HostCustomEntity = DeviceName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostCustomEntity
version: 1.0.2
kind: Scheduled