Scattered Spider TfL Breach: Defending Against Social Engineering and MFA Bypass

---
title: Potential Scattered Spider Activity - Suspicious RMM Tool Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of remote management tools frequently abused by Scattered Spider (e.g., AnyDesk, ScreenConnect, SplashTop) spawned by unusual parent processes like PowerShell or Explorer.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\anydesk.exe'
      - '\connectwisecontrol.exe'
      - '\supremo.exe'
      - '\screenconnect.exe'
      - '\splashtop.exe'
  selection_parent:
    ParentImage|contains:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate IT administration using scripts to launch RMM
level: high
---
title: Suspicious PowerShell Base64 Encoding indicative of Phishing Payloads
id: 9e8d7c6b-5a4f-3e2d-1c0b-9a8f7e6d5c4b
status: experimental
description: Detects PowerShell commands with encoded commands, often used in the initial stages of Scattered Spider phishing droppers to evade detection.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: ' -enc ' 
    CommandLine|contains: ' -encodedcommand '
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
falsepositives:
  - System management scripts
level: medium

// Hunt for MFA Fatigue / Failed MFA followed by immediate Success
// Indicates user may have been spammed into accepting a push
SigninLogs
| where ResultType == "50074" or ResultType == "500121" // MFA failed or interrupted
| project UserPrincipalName, AppDisplayName, DeviceDetail, Location, Status, ConditionalAccessStatus, TimeGenerated
| join kind=inner (
    SigninLogs
    | where ResultType == "0" // Success
    | project SuccessTime=TimeGenerated, UserPrincipalName, AppDisplayName, DeviceDetail, Location
) on UserPrincipalName, AppDisplayName, DeviceDetail
| where TimeGenerated < SuccessTime and (SuccessTime - TimeGenerated) < 5m // Success within 5 mins of failure
| project TimeGenerated, SuccessTime, UserPrincipalName, AppDisplayName, Location, DeviceDetail
| order by TimeGenerated desc

-- Hunt for portable RMM tools often dropped in AppData or Temp by actors
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="\\Users\\*\\AppData\\Local\\Temp\\*.exe")
WHERE Name =~ "anydesk"
   OR Name =~ "supremo"
   OR Name =~ "connectwise"
   OR Name =~ "screenconnect"

-- Hunt for suspicious PowerShell processes encoded payloads
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ "powershell.exe"
   AND CommandLine =~ "-enc"
   AND CommandLine =~ "AQYABg"  // Common header for specific base64 payloads, adjust as needed

# Script to Audit for Unauthorized RMM Tools
# Run with elevated privileges

Write-Host "Scanning for common RMM tools used by threat actors..."

$RMMProcesses = @("anydesk", "splashtop", "supremo", "connectwise", "screenconnect", "dameware", "teamviewer")
$SuspiciousPaths = @("C:\Users\Public\", "C:\Temp\", "C:\Windows\Temp\")

$FoundProcesses = Get-Process | Where-Object { $RMMProcesses -contains $_.ProcessName.ToLower() }

if ($FoundProcesses) {
    Write-Host "[ALERT] Found running RMM processes:" -ForegroundColor Red
    $FoundProcesses | Select-Object ProcessName, Id, Path, StartTime | Format-Table -AutoSize
} else {
    Write-Host "[INFO] No known RMM processes currently running." -ForegroundColor Green
}

# Scan for executable files in suspicious directories matching RMM names
foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path..."
        Get-ChildItem -Path $Path -Recurse -Include *.exe -ErrorAction SilentlyContinue | 
        Where-Object { $RMMProcesses -contains $_.BaseName.ToLower() } | 
        Select-Object FullName, CreationTime, LastWriteTime | Format-Table -AutoSize
    }
}

Write-Host "Audit complete. Review findings for unauthorized access tools."