title: Consent, Owner, Conditional Access or Auth Method Change During ConnectWise Investigation Window
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c06
status: experimental
description: Audit events ConnectWise and Microsoft list as possible persistence or weakened controls (consent grants, new owners, Conditional Access / named location changes, authentication method changes). Review those since 13-15 Oct 2026 against change records.
references:
    - https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1098
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Consent to application'
            - 'Add delegated permission grant'
            - 'Add owner to application'
            - 'Add owner to service principal'
            - 'Add conditional access policy'
            - 'Update conditional access policy'
            - 'Delete conditional access policy'
            - 'Add named location'
            - 'Update named location'
            - 'Delete named location'
            - 'User registered security info'
            - 'Admin registered security info'
            - 'Admin updated security info'
    condition: selection
falsepositives:
    - Routine administration; validate against change tickets
level: medium