skills.rest
powerstacks-corp
powerstacks-corpOFFICIAL
Explore all skills by this author →
WebsiteGitHub

reverse-engineer-intune

Collect Windows evidence and explain Intune management mechanisms in markdown reports.

5|Updated Jun 11, 2026
Search Tags:#timeline#investigation#logs#registry#forensics#intune#ime
One-click install
npx skills add https://github.com/powerstacks-corp/reverse-engineer-intune --skill reverse-engineer-intune
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineer-intune
Source: https://github.com/powerstacks-corp/reverse-engineer-intune/tree/main
Command: npx skills add https://github.com/powerstacks-corp/reverse-engineer-intune --skill reverse-engineer-intune

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ilspycmd, dotnet, winget, Microsoft.OpenJDK.21, Ghidra, and includes scripts (resource) components.

What problem does it solve?

Analyse what Intune actually does on a Windows device by collecting evidence and explaining the real mechanism behind management actions.

Core Features & Use Cases

  • Forensics data collection: gathers IME logs, registry hives, MDM certificates, scheduled tasks, services, and management event logs to build a cohesive evidence map.
  • Investigation + reporting: synthesizes findings into a Rudy-Ooms-style investigative blog post that clarifies the gap between reported state and actual device behavior.
  • Tiered analysis depth: supports Tier 1 read-only collection and can escalate to Tier 2 (Procmon), Tier 3 (IME decompilation), and Tier 4 (native decompilation) as needed.
  • Safety-first output: produces a portable markdown deliverable that documents evidence, mechanism, and open questions for lab replication.

Quick Start

Trigger a scenario by saying go rudy this <scenario> and Claude Code will produce the investigative blog post.

Frequently Asked Questions about reverse-engineer-intune

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate Intune management agent behavior on Windows?▼

To investigate Intune agent behavior on Windows, collect IME logs, registry hives, MDM certificates, scheduled tasks, and event logs to map management actions and identify gaps between reported states and actual device behavior.

What causes gaps between Intune reported check-in state and actual device behavior?▼

Gaps between Intune reported check-in state and actual device behavior occur when local MDM certificates expire or management services fail, which you can uncover by analyzing IME logs and Windows registry data.

How do I decompile the Intune Management Extension to understand its mechanisms?▼

Decompile the Intune Management Extension by escalating analysis to Tier 3 using ilspycmd, or Tier 4 using Ghidra, to inspect native code and clarify the real mechanism behind management actions.

Can I use Procmon to troubleshoot Intune policy application issues?▼

Yes, you can use Procmon to troubleshoot Intune policy application issues by escalating to Tier 2 analysis, capturing real-time file system and registry access to pinpoint where management actions fail.

What is the best way to document Intune forensics findings for lab replication?▼

The best way to document Intune forensics findings for lab replication is to synthesize collected logs, registry, and event data into a portable markdown investigative post detailing evidence, mechanisms, and open questions.

Related Skills

Explore More Data & Analytics Skills→
aivos-xieaivos-xie
1

ai-reverse-engineering

Automate binary code decompilation and analysis with IDA Pro and Ghidra.

Community
Advanced
zebbernzebbern
4.5k

Ethical Hacking Methodology

Structure authorized penetration testing from reconnaissance to reporting.

Community
Advanced
chuangkevinchuangkevin

nuget-decompile-with-ilspycmd

Locates external NuGet types and verifies them with ilspycmd in C# projects.

Community
Intermediate
masakinihirotamasakinihirota

windows-powershell-rules

Enforce native PowerShell cmdlets and UTF8 encoding for Windows command execution.

Community
Basic