ConnectWise Cloud Backup Compromise. Disable. Preserve. Hunt.

Loading queries. If they don't appear, download the full pack below. The .kql file is inside it.

title: ConnectWise Cloud Backup Application Identity Sign-in After Containment
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c02
status: experimental
description: Sign-in by one of the seven ConnectWise Cloud Backup / Cloud Management application IDs that ConnectWise disabled at 07:00 UTC on 17 Oct 2026. Any successful sign-in after that time, or from a non-vendor source, needs investigation.
references:
    - https://www.connectwise.com/company/trust/advisories
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1195
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AppId:
            - '506e08f9-6e9a-4da4-942b-a099a03644ae'
            - '2399d300-6fca-4e6a-a686-399fefe75b83'
            - '24205314-2b89-4e07-a2a4-579e898a5640'
            - 'b78f6a77-d4e5-46fb-87e5-d1648bd02519'
            - '0de14c77-b9b0-4137-9360-34878a929827'
            - '412dcf96-176d-4b3a-a1b0-4981ad66971e'
            - 'b2b55f5b-7758-4719-8d8f-88ae172e6bdb'
    condition: selection
falsepositives:
    - Legitimate vendor backup activity before 17 Oct 2026 07:00 UTC (kiota-dotnet user agent and Azure private IPv6 sources are associated with expected vendor activity per ConnectWise)
level: medium

title: ConnectWise Cloud Backup Storm-0940 IOC IP Sign-in
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c01
status: experimental
description: Entra ID sign-in (user or service principal) from IP addresses Microsoft and ConnectWise published for the ConnectWise Cloud Backup (formerly SkyKick) application-identity compromise attributed to Storm-0940. The 187.15.x VPN addresses are only meaningful on 15-16 Oct 2026.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://www.connectwise.com/company/trust/advisories
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1078.004
    - attack.t1195
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        IPAddress:
            - '144.172.64.128'
            - '144.172.64.99'
            - '144.172.64.60'
            - '187.15.88.186'
            - '187.15.90.217'
            - '187.15.89.186'
    condition: selection
falsepositives:
    - VPN addresses (187.15.x) are shared and transient; outside 15-16 Oct 2026 matches are likely unrelated
level: high

title: Storm-0940 ConnectWise Campaign User Agent in Entra Sign-in
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c03
status: experimental
description: Entra ID sign-in with a user agent Microsoft observed in Storm-0940 sign-ins and Graph activity via ConnectWise apps. Low fidelity on its own; correlate with app ID and IP.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        UserAgent:
            - 'Python-urllib/3.12'
            - 'python-requests/2.31.0'
            - 'python-requests/2.34.2'
            - 'curl/7.88.1'
            - 'azure-toolkit/1.0'
    condition: selection
falsepositives:
    - Legitimate administrator scripts and automation (ConnectWise notes scripting clients are also used by legitimate admins)
level: low

title: Credential Added to Application or Service Principal
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c04
status: experimental
description: A secret or certificate was added to an application or service principal. Storm-0940 added credentials to OAuth applications for persistence; these survive disabling the original ConnectWise app. Review all events since 15 Oct 2026.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf
author: Cybaverse
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1098.001
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Add service principal credentials'
            - 'Update application – Certificates and secrets management'
            - 'Update application - Certificates and secrets management'
    condition: selection
falsepositives:
    - Planned secret or certificate rotation
level: medium

title: Directory Role or App Role Granted to a Service Principal
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c05
status: experimental
description: A directory role (e.g. Global Administrator) or app role was assigned to a service principal. Microsoft observed self-assignment of Global Administrator by a ConnectWise management application.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098.003
logsource:
    product: azure
    service: auditlogs
detection:
    selection_role:
        OperationName: 'Add member to role'
        TargetResources|contains: 'ServicePrincipal'
    selection_approle:
        OperationName: 'Add app role assignment to service principal'
    condition: 1 of selection_*
falsepositives:
    - Onboarding of legitimate automation or vendor apps
level: high

title: Consent, Owner, Conditional Access or Auth Method Change During ConnectWise Investigation Window
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c06
status: experimental
description: Audit events ConnectWise and Microsoft list as possible persistence or weakened controls (consent grants, new owners, Conditional Access / named location changes, authentication method changes). Review those since 13-15 Oct 2026 against change records.
references:
    - https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1098
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Consent to application'
            - 'Add delegated permission grant'
            - 'Add owner to application'
            - 'Add owner to service principal'
            - 'Add conditional access policy'
            - 'Update conditional access policy'
            - 'Delete conditional access policy'
            - 'Add named location'
            - 'Update named location'
            - 'Delete named location'
            - 'User registered security info'
            - 'Admin registered security info'
            - 'Admin updated security info'
    condition: selection
falsepositives:
    - Routine administration; validate against change tickets
level: medium