ConnectWise Supply-Chain Attack: Defending Microsoft 365 Tenants Against Compromised API Secret Abuse

---
title: Suspicious App-Only Token Acquisition by Third-Party Service Principal
id: 8b3f2e41-5c7a-4d19-bf62-9a1c4e7d3f08
status: experimental
description: Detects non-interactive service principal sign-ins from unusual network locations or ASNs, consistent with abuse of a stolen API secret or client credential as seen in the ConnectWise supply-chain incident.
references:
  - https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/
  - https://attack.mitre.org/techniques/T1550/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1550
  - attack.t1528
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    signInLogs.properties.authenticationProtocol|contains: 'none'
    signInLogs.properties.isInteractive: 'false'
  filter_known_asn:
    signInLogs.properties.networkLocationDetails|contains:
      - 'KNOWN_MSP_ASN_1'
      - 'KNOWN_MSP_ASN_2'
  condition: selection and not filter_known_asn
falsepositives:
  - Legitimate third-party service principals authenticating from new datacenter egress ranges
  - MSP infrastructure migration to new hosting providers
level: high
---
title: New Credential or Permission Added to Enterprise Application
id: 2c9d7f06-3a51-4e84-9d5b-6f1a8c2e4b77
status: experimental
description: Detects additions of client secrets, certificates, or app role assignments to service principals, a common follow-on action after compromising an MSP-integrated M365 application to establish persistence independent of the original vendor credential.
references:
  - https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/
  - https://attack.mitre.org/techniques/T1098.001/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.privilege_escalation
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    auditLogs.operationName|contains:
      - 'Add service principal credentials'
      - 'Add app role assignment to service principal'
      - 'Consent to application'
      - 'Update application - Certificates and secrets management'
  condition: selection
falsepositives:
  - Legitimate application onboarding and consent workflows
  - Scheduled credential rotation by IT or the vendor
level: high
---
title: Mass Mailbox or SharePoint Access by Application Identity
id: 4e1b8a92-7f3d-4c56-a890-1d6f3e9b5a24
status: experimental
description: Detects bulk MailItemsAccessed or FileSyncDownloadedFull operations attributed to application identities, indicative of data collection or exfiltration through a compromised backup/management application.
references:
  - https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.collection
  - attack.t1530
  - attack.exfiltration
  - attack.t1567
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    auditLogs.operationName|contains:
      - 'MailItemsAccessed'
      - 'FileSyncDownloadedFull'
      - 'SearchQueryPerformed'
    auditLogs.logonType: '0'
  condition: selection
falsepositives:
  - Legitimate backup application indexing and synchronization jobs
  - eDiscovery operations performed through third-party tooling
level: medium

// Hunt 1: App-only sign-ins by service principals from anomalous IPs/ASNs
// Compare against your documented ConnectWise/MSP egress ranges
let KnownMSPRanges = dynamic(["203.0.113.0/24", "198.51.100.0/24"]); // REPLACE with actual vendor ranges
SigninLogs
| where TimeGenerated > ago(30d)
| where IsInteractive == false
| where AppDisplayName has_any ("ConnectWise", "backup", "msp") or AppId in (/* your consented app IDs */ dynamic([]))
| extend IPinKnownRange = ipv4_is_in_any_range(IPAddress, KnownMSPRanges)
| where IPinKnownRange == false
| summarize SignInCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Locations = make_set(Location), UserAgents = make_set(UserAgent)
    by AppDisplayName, AppId, IPAddress
| order by SignInCount desc;

// Hunt 2: New credentials or consent grants on service principals during exposure window
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName has_any ("Add service principal credentials", "Consent to application",
    "Add app role assignment to service principal", "Update application")
| mv-expand TargetResources
| extend AppName = tostring(TargetResources.displayName)
| where AppName has_any ("ConnectWise") or OperationName has "Add service principal credentials"
| project TimeGenerated, OperationName, AppName, InitiatedBy = tostring(InitiatedBy.user.userPrincipalName),
    IPAddress = tostring(InitiatedBy.user.ipAddress), Result
| order by TimeGenerated desc;

// Hunt 3: Abnormal Graph API / mailbox access volume by application identity
// Requires MicrosoftGraphActivityLogs and/or OfficeActivity (MailItemsAccessed)
MicrosoftGraphActivityLogs
| where TimeGenerated > ago(30d)
| summarize RequestCount = count(), DistinctResources = dcount(tostring(RequestUri)),
    Verbs = make_set(RequestMethod) by AppId, bin(TimeGenerated, 1h)
| join kind=leftouter (
    MicrosoftGraphActivityLogs
    | where TimeGenerated between (ago(90d) .. ago(30d))
    | summarize BaselineAvg = avg(RequestCount) by AppId, bin(TimeGenerated, 1h)
) on AppId
| where RequestCount > BaselineAvg * 5
| order by RequestCount desc;

-- Hunt for processes accessing ConnectWise configuration and credential stores,
-- plus suspicious child processes spawned by ConnectWise services
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(client_secret|apikey|api_key|clientsecret|secret)'
   OR (Name =~ '(?i)(ScreenConnect|ConnectWise|CWAutomate|LabTech)'
       AND Ppid NOT IN (
         SELECT Pid FROM pslist() WHERE Name =~ '(?i)(services|svchost|ScreenConnect)'
       ))
   OR Exe =~ '(?i)\\\\(temp|appdata\\\\local\\\\temp|programdata)\\\\.*\\\\.(exe|ps1|bat)'

-- Enumerate recently modified ConnectWise config files that may hold secrets
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Program Files*/ConnectWise*/**/*.config',
                 'C:/Program Files*/ConnectWise*/**/*.json',
                 'C:/ProgramData/ConnectWise*/**/*.config'],
          accessor='ntfs')
WHERE Mtime > now() - (90 * 24 * 3600)
ORDER BY Mtime DESC

# ConnectWise M365 Tenant Audit & Hardening Script
# Run as Global Admin / Cloud App Admin. Requires: Microsoft.Graph module
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","AuditLog.Read.All"

# 1. Locate ConnectWise-related service principals in the tenant
$spns = Get-MgServicePrincipal -All | Where-Object {
    $_.DisplayName -match 'ConnectWise|ScreenConnect|Automate|Continuum' -or
    $_.PublisherName -match 'ConnectWise'
}
$spns | Select-Object DisplayName, AppId, CreatedDateTime,
    @{N='SecretCount';E={($_.PasswordCredentials).Count}},
    @{N='CertCount';E={($_.KeyCredentials).Count}} | Format-Table -AutoSize

# 2. Flag aging secrets and expired/near-expiry credentials for rotation
foreach ($sp in $spns) {
    foreach ($cred in $sp.PasswordCredentials) {
        $ageDays = ((Get-Date) - $cred.StartDateTime).Days
        if ($ageDays -gt 90) {
            Write-Warning "$($sp.DisplayName): secret aged $ageDays days (KeyId $($cred.KeyId)) - ROTATE/REVOKE"
        }
    }
}

# 3. Enumerate app role assignments (consented Graph permissions) per SP
foreach ($sp in $spns) {
    Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id |
        Select-Object @{N='SP';E={$sp.DisplayName}}, AppRoleId, ResourceDisplayName, CreatedDateTime
}

# 4. Revoke a compromised secret (UNCOMMENT after coordinating with ConnectWise)
# Remove-MgServicePrincipalPassword -ServicePrincipalId <SP_OBJECT_ID> -KeyId <KEY_ID>

# 5. Harden: restrict who can consent to apps going forward
$params = @{ defaultUserRolePermissions = @{ permissionGrantPoliciesAssigned = @() } }
Update-MgPolicyAuthorizationPolicy -BodyParameter $params
Write-Host "User consent disabled. Require admin consent workflow for new app grants." -ForegroundColor Green