Bring Your Own Policy: Weaponizing ADMX for Cloud-to-On-Prem Lateral Movement | Hacker Summer 2026

This webinar details a "Bring Your Own Policy" attack that weaponizes Microsoft Intune Administrative Templates via the Office 365 Client Admin App to achieve remote code execution and lateral movement from cloud to on-premises environments 0:40.

Key Takeaways:
• Intune’s MDM capabilities allow high-privilege script execution, making it a primary target for cloud-to-on-prem lateral movement 10:00.
• Microsoft patched direct PowerShell script execution via the Intune Company Portal in August 2025 by removing necessary permission scopes 40:50.
• Researchers discovered a novel technique using the "Office 365 Client Admin App" ID to push weaponized ADM policies, bypassing script restrictions 41:30.
• The attack utilizes a specific registry key (HKLM\Software\Classes\CLSID\{...}\shell\opennewwindow\command) not blocked by Intune, allowing code execution when File Explorer is opened 57:20.
• The demonstration showed downloading a reverse shell via curl and executing it using installutil.exe to evade Windows Defender detection 59:30.
• Defense strategies include enforcing U2F/FIDO2 keys for admin accounts, enabling multi-admin approval for sensitive actions, and monitoring for bulk policy changes 21:50.

This research highlights the evolving nature of hybrid cloud attacks, where threat actors continuously adapt to Microsoft's security patches by finding new legitimate features to abuse for persistent access.

Sources:

• 0:40 Introduction to the "Bring Your Own Policy" attack vector and webinar context.
• [10:00](https://www.youtu