ConnectWise Cloud Backup / SkyKick M365 Credential Abuse: OTX Detection Pack — Microsoft Graph Token Access Across Hundreds of Tenants

---
title: Suspect OTX Infrastructure Authenticating To Microsoft Cloud
id: 9b5f8d0e-6b1d-4db4-9f25-ctwskykick001
status: experimental
description: Detects successful or failed authentication activity to Microsoft cloud services from OTX-listed IPs tied to ConnectWise/SkyKick credential abuse.
author: Security Arsenal
date: 2026/10/19
references:
  - 'https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access'
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    IPAddress:
      - '144.172.64.60'
      - '144.172.64.99'
      - '144.172.64.128'
  selection_cloud:
    AppDisplayName|contains:
      - 'ConnectWise'
      - 'SkyKick'
      - 'Cloud Backup'
      - 'Microsoft Graph'
  condition: selection_ip or (selection_ip and selection_cloud)
falsepositives:
  - Vendor SOC, backup orchestration hosts, or customer egress NAT may coincidentally use adjacent infrastructure; verify ASN, tenant ID, app ID, and service principal ID before containment.
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1550
---
title: Service Principal Credential Or Consent Change After Cloud Backup Access
id: 7e1d5a35-0b8c-4f67-a2b8-ctwskykick002
status: experimental
description: Detects additions of app secrets, certificates, federated credentials, or admin consent around the same window as suspicious Microsoft Graph access by backup or MSP applications.
author: Security Arsenal
date: 2026/10/19
logsource:
  product: azure
  service: auditlogs
detection:
  selection_ops:
    OperationName|contains:
      - 'Add service principal credentials'
      - 'Update application'
      - 'Consent to application'
      - 'Add app role assignment'
      - 'Add delegated permission grant'
      - 'Add federated credentials'
  selection_target:
    TargetResources|contains:
      - 'ConnectWise'
      - 'SkyKick'
      - 'Cloud Backup'
      - 'backup'
      - 'msp'
  condition: selection_ops and selection_target
falsepositives:
  - Scheduled certificate rotation by the vendor; require change ticket, initiator, source IP, and correlation to unusual token activity.
level: critical
tags:
  - attack.persistence
  - attack.t1098
  - attack.t1136
  - attack.t1550
---
title: Bulk Multi Tenant Microsoft Graph Token Or Read Pattern
id: 1e2c734d-93b4-4b0b-a320-ctwskykick003
status: experimental
description: Identifies high-volume Graph token issuance or API reads across many tenants by a single app, service principal, or IP, consistent with sorted GUID tenant traversal.
author: Security Arsenal
date: 2026/10/19
logsource:
  category: cloud
detection:
  selection_graph:
    resource|contains:
      - 'graph.microsoft.com'
      - 'login.microsoftonline.com'
  selection_vendor_context:
    app_display_name|contains:
      - 'ConnectWise'
      - 'SkyKick'
      - 'Cloud Backup'
      - 'backup'
  condition: selection_graph and selection_vendor_context
falsepositives:
  - Legitimate nightly backup windows can be broad; alert when tenant count, token count, source ASN, or time-of-day deviates from the vendor baseline.
level: medium
tags:
  - attack.collection
  - attack.t1530
  - attack.t1213
  - attack.t1550

let iocs = dynamic(['144.172.64.60','144.172.64.99','144.172.64.128']);
let lookback = 14d;
let VendorHits = union isfuzzy=true
    (SigninLogs
    | where TimeGenerated >= ago(lookback)
    | where IPAddress in (iocs) or AppDisplayName has_any ('ConnectWise','SkyKick','Cloud Backup')
    | project TimeGenerated, IPAddress, AppDisplayName, AppId, ServicePrincipalId, TenantId, UserPrincipalName, ResultType, ResultDescription, AuthenticationRequirement, ClientAppUsed, UserAgent),
    (AADServicePrincipalSignInLogs
    | where TimeGenerated >= ago(lookback)
    | where IPAddress in (iocs) or ServicePrincipalName has_any ('ConnectWise','SkyKick','Cloud Backup')
    | project TimeGenerated, IPAddress, ServicePrincipalName, ServicePrincipalId, AppId, TenantId, ResultType, ResultDescription),
    (AuditLogs
    | where TimeGenerated >= ago(lookback)
    | where OperationName has_any ('Add service principal credentials','Consent to application','Update application','Add app role assignment','Add delegated permission grant','Add federated credentials')
    | where tostring(TargetResources) has_any ('ConnectWise','SkyKick','backup','Cloud Backup') or InitiatedBy has_any ('ConnectWise','SkyKick')
    | project TimeGenerated, OperationName, InitiatedBy, TargetResources, Result, IPAddress=tostring(parse_json(InitiatedBy).user.ipAddress), CorrelationId);
VendorHits
| summarize Events=count(), DistinctTenants=dcount(TenantId), First=min(TimeGenerated), Last=max(TimeGenerated) by IPAddress, AppDisplayName, ServicePrincipalId, TenantId, OperationName
| where IPAddress in (iocs) or DistinctTenants > 10 or OperationName has_any ('Add service principal credentials','Consent to application')
| sort by Events desc, DistinctTenants desc;

$ErrorActionPreference = 'SilentlyContinue'
$Iocs = @('144.172.64.60','144.172.64.99','144.172.64.128')
$Report = @()
Get-NetTCPConnection | Where-Object { $Iocs -contains $_.RemoteAddress -or $_.RemotePort -in 443,4443 } | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess
  $Report += [pscustomobject]@{Type='Network'; Local=$_.LocalAddress; Remote=$_.RemoteAddress; State=$_.State; Process=$p.ProcessName; Path=$p.Path; PID=$_.OwningProcess}
}
Get-DnsClientCache | Where-Object { $_.Data -and ($Iocs | Where-Object { $_ -eq $_.Data }) } | ForEach-Object {
  $Report += [pscustomobject]@{Type='DNSCache'; Name=$_.Name; Data=$_.Data}
}
$RunKeys = @('HKCU:\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run','HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run')
foreach ($k in $RunKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'connectwise|skykick|backup|graph|login.microsoftonline' } | ForEach-Object { $Report += [pscustomobject]@{Type='RunKey'; Key=$k; Name=$_.Name; Value=$_.Value} } } }
Get-ScheduledTask | Where-Object { $_.TaskName -match 'connectwise|skykick|backup|graph' -or ($_.Actions.Arguments -match 'login.microsoftonline|graph.microsoft.com') } | ForEach-Object {
  $Report += [pscustomobject]@{Type='ScheduledTask'; Name=$_.TaskName; Path=$_.TaskPath; Action=($_.Actions | Out-String)}
}
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} | Where-Object { $_.Message -match '144.172.64|graph.microsoft.com|login.microsoftonline|ConnectWise|SkyKick' } | ForEach-Object {
  $Report += [pscustomobject]@{Type='ProcessStart'; Time=$_.TimeCreated; Message=($_.Message -replace '\\s+',' ').Substring(0,[Math]::Min(500,$_.Message.Length))}
}
$Report | Export-Csv -NoTypeInformation -Path "$env:TEMP\\skykick_m365_hunt.csv"
$Report | Format-Table -AutoSize