Threat Modeling and Detection in Operation: Analysis of the 2026 Stryker Intune Incident

In Q1 of 2026, perhaps the most shocking news in cybersecurity was the Stryker Intune “Wipe” attack. The incident resulted in the factory reset of an estimated 200,000 devices globally, achieved by weaponizing the built-in Microsoft Intune "Wipe" command after compromising a single administrative credential. Notably, the attackers chose not to deploy ransomware. As a prominent medical technology provider, Stryker saw its critical systems crippled, including those supporting ordering and shipping, which aligned perfectly with the attacker’s primary motive: major business disruption.

Whenever news breaks regarding a major attack on a well-known company, cybersecurity professionals must be prepared to answer the CEO's inevitable question: "Could this happen to our organization?"

This reality was the primary motivation for this post: to demonstrate a process where threat modeling is utilized to link such an incident to the potential impact of a similar attack on an organization within its own business context, which is exactly the perspective CEOs and management need to understand. This process also includes the essential step of implementing detection and monitoring controls to safeguard the business. By utilizing threat hunting to investigate these threats at the operational level, organizations can provide tangible protection against the attack path. In this post, the attack vector will be dissected to simulate and implement a threat hunting query, demonstrating a detection mechanism for such an event by showcasing the results in practice.

Threat modeling is a structured, proactive process for identifying, quantifying, and mitigating security threats to a system, application, or business process. While many frameworks exist, PASTA (Process for Attack Simulation and Threat Analysis) was chosen for this case due to its risk-centric approach and its ability to provide clear business context for technical threats.

In this example, the PASTA framework is used retrospectively to build threat hunting playbooks with a risk-based perspective, alongside vulnerability remediation strategies for a hypothetical organization, "Logicorp":

The implementation of this threat modeling step promotes cross-functional collaboration, linking business leadership to security functions (GRC and SecOps). It translates business vulnerabilities into technical gaps, as the framework requires identifying not only business priorities but also technical details. This empowers SecOps to prioritize the most effective controls among multiple options, ensuring the most critical business functions are protected against the risks identified. Consequently, as you see in the PASTA framework diagram above, the first step of the framework provides the business justification for the technical controls necessary to defend against a specific attack.

In practice, this stage should be a streamlined process involving key stakeholders to ensure information accuracy and effective communication. By involving GRC in the right context, this approach bridges the gap between risk controls and operations. However, to maintain efficiency, it must remain an agile process; implementing the right controls is a time-sensitive endeavor where protection must be established before an incident occurs.

The Stryker incident was not a traditional malware infection; it was a sophisticated "Living-off-the-Land" (LotL) attack. In an LotL attack, an adversary leverages legitimate, pre-installed system tools and administrative software to execute malicious actions. Unlike traditional attacks that rely on custom malware or external payloads, LotL techniques turn a system’s own features against itself. In the Stryker case, the Microsoft Intune "Wipe" command served as the primary weapon. The attacker required no virus; they simply abused a built-in, trusted administrative function for destructive purposes.

LotL attacks’ specific characteristics allow threat actors to remain under the radar and evade standard detection:

• Evasion of Detection: Because tools like PowerShell, WMI, or Intune are digitally signed by trusted vendors, they frequently bypass traditional Antivirus (AV) and Endpoint Detection and Response (EDR) filters designed to hunt for "known-bad" files.
• Built-in Trust: These tools are essential for daily IT operations. This makes it exceptionally difficult for security teams to distinguish between a legitimate administrator performing a routine task and an attacker abusing the same command.
• Reduced Footprint: By utilizing existing software, the attacker leaves fewer "footprints" on the disk, making forensic recovery significantly more challenging than a standard malware infection.

The critical lesson here is that the trusted control plane can be compromised to launch a catastrophic attack. In this instance, the operation was executed with calculated simplicity and clear motive by "Handala," a known Iran-linked threat actor group.

As the PASTA threat model suggests, the attack path can be mapped to the MITRE ATT&CK framework. This mapping is essential for designing precise detection logic for attacks that are otherwise difficult to surface. By using MITRE ATT&CK, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, organizations can visualize detection gaps and develop relevant detection logic, such as KQL (for Microsoft Sentinel) or Sigma rules.

The ATT&CK Navigator (shown below) further allows us to visualize specific TTPs (Tactics, Techniques, and Procedures), assess existing coverage, and proactively identify the known behaviors of Advanced Persistent Threat (APT) groups like Handala to understand the components of the attacks and ensure more effective containment.

Once the MITRE ATT&CK framework identifies specific TTPs, detection logic can be constructed based on those indicators. The procedure of proactively searching for these indicators to ensure early detection and better containment is known as Threat Hunting.

Threat Hunting is a proactive, hypothesis-driven defense strategy where security analysts manually search through networks and datasets to identify malicious activity that has bypassed automated security tools. Unlike standard "alert-based" monitoring, which waits for a system to flag a known threat, threat hunting operates under the assumption that a breach may have already occurred. It focuses on uncovering subtle "indicators of attack" (IoAs) or behavioral anomalies that automated systems like Antivirus or EDR might miss, particularly in Living-off-the-Land (LotL) scenarios.

To conduct effective threat hunting, detection logic is built and queries tailored to the environment are also written. While threat hunting can be performed in any SIEM solution, each requires a specific query language. In this simulation, the attack was detected using Microsoft Sentinel, utilizing KQL (Kusto Query Language).

The Targeted Attack Scenario

The detection logic focuses on the following TTP sequence:

1. Compromise: A high-privileged Microsoft 365 account (Global Administrator) is compromised.
2. Persistence: The threat actor creates a new administrative account and assigns it the Intune Administrator role to facilitate the destructive phase.
3. Impact: Shortly after the account is created, a mass wipe/factory reset command is issued via Intune.

Attack Mapping: Kill Chain & ATT&CK TTPs:

To effectively capture the Handala-style attack path, the threat hunting logic is divided into two distinct phases: identifying the Persistence Precursor and detecting the Critical Impact.

Logic: A high-privileged Global Admin logs in from a suspicious or new IP ("Impossible Travel") and immediately performs a persistence action by assigning the Intune Administrator role to a newly created or existing account.

Detecting this early entry is a crucial indicator. Even if automated countermeasures are in place to block a factory reset, identifying this unauthorized role assignment allows for containment before the "Impact" phase begins.

KQL Query: Impossible Travel + Privileged Role Assignment

Detection in Sentinel:

Note: During the investigation phase, analysts should also monitor for Conditional Access Policy modifications, as attackers often attempt to bypass MFA for their newly created persistence accounts.

Logic: A Wipe or Factory Reset command is executed in Intune by the suspicious account identified in Stage 1.

This confirms that a destructive attack has been launched within the environment. At this stage, immediate intervention is required, such as revoking the credentials of the initiating account and killing all active sessions.

While the Intune GUI limits bulk actions to 100 devices at a time, attackers utilizing PowerShell or Microsoft Graph API can cause significantly more damage in a shorter window. Identifying the "Wipe" log in Sentinel provides the definitive evidence needed to trigger an emergency lockdown and prevent further asset loss.

KQL: Wipe Command

Detection in Sentinel:

The Stryker incident serves as a stark reminder that our most powerful administrative tools can become our greatest liabilities when compromised. By applying the PASTA framework, we move beyond the simple fear of a "million-dollar question" and into a structured reality where business risk management and technical defense work in parallel. Threat hunting is the operational glue in this process; it allows identifying the subtle precursors of a "Living-off-the-Land" attack, such as the suspicious role assignments and impossible travel patterns identified in the detection, before they escalate into a catastrophic bulk wipe. Ultimately, the goal of this integrated approach is resilience. By aligning GRC’s strategic oversight with SecOps’ tactical visibility, organizations can ensure that attackers find it increasingly challenging to "live off the land" undetected.