title: ConnectWise Cloud Backup Application Identity Sign-in After Containment
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c02
status: experimental
description: Sign-in by one of the seven ConnectWise Cloud Backup / Cloud Management application IDs that ConnectWise disabled at 07:00 UTC on 17 Oct 2026. Any successful sign-in after that time, or from a non-vendor source, needs investigation.
references:
    - https://www.connectwise.com/company/trust/advisories
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1195
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AppId:
            - '506e08f9-6e9a-4da4-942b-a099a03644ae'
            - '2399d300-6fca-4e6a-a686-399fefe75b83'
            - '24205314-2b89-4e07-a2a4-579e898a5640'
            - 'b78f6a77-d4e5-46fb-87e5-d1648bd02519'
            - '0de14c77-b9b0-4137-9360-34878a929827'
            - '412dcf96-176d-4b3a-a1b0-4981ad66971e'
            - 'b2b55f5b-7758-4719-8d8f-88ae172e6bdb'
    condition: selection
falsepositives:
    - Legitimate vendor backup activity before 17 Oct 2026 07:00 UTC (kiota-dotnet user agent and Azure private IPv6 sources are associated with expected vendor activity per ConnectWise)
level: medium