Cordial Spider & Snarky Spider: SaaS Extortion via Vishing and SSO Abuse — Detection & Response Guide

---
title: Potential MFA Fatigue Vishing Attack - SaaS
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential MFA fatigue attacks (vishing) characterized by multiple failed MFA attempts followed immediately by a success on the same account.
references:
  - https://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection_failure:
    Status: Failure
    ConditionalAccessStatus: "failure"
    AuthenticationRequirement: "multiFactorAuthentication"
  selection_success:
    Status: Success
  filter:
    UserPrincipalName|startswith: "service_" # Filter out noisy service accounts
  timeframe: 5m
  condition: selection_failure | count(UserPrincipalName) by UserPrincipalName, AppDisplayName > 5 | filter (
    selection_success by UserPrincipalName
  )
falsepositives:
  - Legitimate users forgetting credentials/MFA issues
level: high
---
title: SaaS Admin Role Assignment via Suspicious Location
description: Detects the addition of a user to a privileged administrative role (e.g., Global Admin) from a new or risky location/network often associated with initial compromise.
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
references:
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.persistence
  - attack.t1098.003
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: 'RoleManagement'
    Operation|contains:
      - 'Add member to role'
      - 'Assign role'
    TargetProperties|contains: 
      - 'Global Administrator'
      - 'User Administrator'
      - 'Exchange Administrator'
  condition: selection
falsepositives:
  - Legitimate administrative delegation by IT staff
level: critical

// Hunt for MFA Fatigue / Vishing Indicators
// Look for users with >5 MFA failures followed by a success within 15 mins
let Threshold = 5;
let TimeWindow = 15m;
SigninLogs
| where ConditionalAccessStatus == "failure" and Status == "Failure"
| where AuthenticationRequirement == "multiFactorAuthentication"
| summarize FailedCount = count(), FailedIPs = make_set(IPAddress), FailureTime = max(TimeGenerated) by UserPrincipalName, AppId
| where FailedCount >= Threshold
| join kind=inner (
    SigninLogs
    | where Status == "Success"
    | summarize SuccessCount = count(), SuccessIPs = make_set(IPAddress), SuccessTime = min(TimeGenerated) by UserPrincipalName, AppId
) on UserPrincipalName, AppId
| where datetime_diff('minute', SuccessTime, FailureTime) <= TimeWindow
| project UserPrincipalName, AppId, FailedCount, FailedIPs, SuccessIPs, FailureTime, SuccessTime
| extend RiskDetails = pack("Failed_IPs", FailedIPs, "Success_IPs", SuccessIPs, "Time_Delta_Min", datetime_diff('minute', SuccessTime, FailureTime))

-- Hunt for PowerShell processes using Exchange Online modules
-- commonly used in SaaS extortion for bulk data export
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "powershell.exe"
  AND (CommandLine =~ "Connect-ExchangeOnline" 
       OR CommandLine =~ "New-MailboxExportRequest" 
       OR CommandLine =~ "Search-Mailbox")

-- Hunt for network connections to known SaaS endpoints
-- initiated by automation tools (PowerShell) potentially downloading data
SELECT Name, Pid, RemoteAddress, RemotePort, State
FROM netstat()
WHERE Name =~ "powershell.exe"
  AND (RemoteAddress =~ "outlook.office365.com" 
       OR RemoteAddress =~ "graph.microsoft.com" 
       OR RemoteAddress =~ "api的保护.microsoft.com")

# Script to Audit and Remediate Suspicious Role Assignments
# Requires ExchangeOnlineManagement and Microsoft.Graph modules

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "RoleManagement.Read.Directory", "RoleManagement.ReadWrite.Directory", "AuditLog.Read.All"

# Check for Role Assignments made in the last 24 hours
$Date = (Get-Date).AddDays(-1)
$SuspiciousAssignments = Get-MgDirectoryRole -ExpandProperty Members | 
    Where-Object { $_.Members.AdditionalProperties['createdDateTime'] -gt $Date }

if ($SuspiciousAssignments) {
    Write-Host "[!] WARNING: Found recent role assignments:" -ForegroundColor Red
    $SuspiciousAssignments | Format-List DisplayName, Id
    
    # Option to Revoke (Uncomment to execute)
    # foreach ($assignment in $SuspiciousAssignments) {
    #     Remove-MgDirectoryRoleMember -DirectoryRoleId $assignment.Id -MemberId $assignment.Members.Id
    # }
} else {
    Write-Host "[+] No suspicious role assignments found in the last 24 hours." -ForegroundColor Green
}

# Check for newly created Guest Users (Common backdoor)
$Guests = Get-MgUser -Filter "UserType eq 'Guest'" -All | 
    Where-Object { $_.CreatedDateTime -gt $Date }

if ($Guests) {
    Write-Host "[!] WARNING: Found new Guest Users created in the last 24 hours:" -ForegroundColor Yellow
    $Guests | Select-Object DisplayName, UserPrincipalName, CreatedDateTime
} else {
    Write-Host "[+] No new Guest Users found." -ForegroundColor Green
}