title: Storm-0940 ConnectWise Campaign User Agent in Entra Sign-in
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c03
status: experimental
description: Entra ID sign-in with a user agent Microsoft observed in Storm-0940 sign-ins and Graph activity via ConnectWise apps. Low fidelity on its own; correlate with app ID and IP.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        UserAgent:
            - 'Python-urllib/3.12'
            - 'python-requests/2.31.0'
            - 'python-requests/2.34.2'
            - 'curl/7.88.1'
            - 'azure-toolkit/1.0'
    condition: selection
falsepositives:
    - Legitimate administrator scripts and automation (ConnectWise notes scripting clients are also used by legitimate admins)
level: low