ShinyHunters Social Engineering Incident at ReliaQuest: Identity, Help Desk, and MSSP Defense Guide

---
title: High Risk Entra ID Sign-In With New Device or Unfamiliar Network
description: Detects successful interactive sign-ins marked risky or coming from unfamiliar locations, a common post-social-engineering signal after MFA push approval or credential capture.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1621/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: azure
  category: signinlogs
detection:
  selection_success:
    status.errorCode: 0
    authenticationRequirement: multiFactorAuthentication
  selection_risk:
    riskLevelDuringSignIn:
      - high
      - medium
  selection_context:
    deviceDetail.deviceId: null
  condition: selection_success and selection_risk
falsepositives:
  - Users traveling with legitimate new devices
  - Conditional Access testing in controlled pilots
level: high
---
title: Entra ID Authentication Method or Password Change Around Sign-In Anomaly
description: Flags audit operations where MFA methods, phone numbers, or credentials are changed, especially relevant when help desk social engineering is suspected.
references:
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: azure
  category: auditlogs
detection:
  selection_ops:
    operationName|contains:
      - 'Update user'
      - 'Reset user password'
      - 'Admin resets user password'
      - 'Update authentication methods'
      - 'User registered security info'
      - 'User changed default MFA method'
  selection_targets:
    targetResources.type:
      - User
      - AuthenticationMethod
  condition: selection_ops and selection_targets
falsepositives:
  - Normal joiner, mover, leaver operations
  - Scheduled self-service password reset campaigns
level: medium
---
title: OAuth Consent or Service Principal Credential Addition After User Interaction
description: Detects consent grants and app credential additions that can convert a phished session into persistent cloud access.
references:
  - https://attack.mitre.org/techniques/T1550/
  - https://attack.mitre.org/techniques/T1098.001/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: azure
  category: auditlogs
detection:
  selection_ops:
    operationName|contains:
      - 'Consent to application'
      - 'Add service principal credentials'
      - 'Add application'
      - 'Update application'
  selection_scope:
    targetResources.modifiedProperties.displayName|contains:
      - 'Mail.Read'
      - 'Files.Read'
      - 'Directory.Read'
      - 'offline_access'
      - 'full_access_as_app'
  condition: selection_ops
falsepositives:
  - Approved enterprise application onboarding
  - Developer tenant testing isolated from production
level: high

// Correlate MFA failures, risky success, authentication method changes, mailbox rules, OAuth consent, and remote tool process starts.
let lookback = 14d;
let risky = SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| where RiskLevelDuringSignIn in ('medium','high') or IsRisky == true
| project UserPrincipalName, IPAddress, Location, AppDisplayName, DeviceDetail, TimeGenerated, CorrelationId;
let mfaPressure = SigninLogs
| where TimeGenerated > ago(lookback)
| summarize FailedMFA=countif(ResultType != 0 and AuthenticationRequirement == 'multiFactorAuthentication'), Success=countif(ResultType == 0) by UserPrincipalName, IPAddress, bin(TimeGenerated, 30m)
| where FailedMFA >= 5 and Success >= 1;
let authChanges = AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ('Update user','Reset user password','Admin resets user password','Update authentication methods','User registered security info')
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, InitiatedBy, TargetUser, CorrelationId;
let consent = AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ('Consent to application','Add service principal credentials','Add application')
| project TimeGenerated, OperationName, InitiatedBy, TargetResources, CorrelationId;
risky
| join kind=leftouter mfaPressure on UserPrincipalName
| join kind=leftouter authChanges on $left.UserPrincipalName == $right.TargetUser
| join kind=leftouter consent on $left.UserPrincipalName == tostring($right.InitiatedBy.user.userPrincipalName)
| project UserPrincipalName, IPAddress, Location, AppDisplayName, FailedMFA, OperationName, OperationName1, TimeGenerated, CorrelationId
| order by TimeGenerated desc;

-- Endpoint hunt for remote support and RMM tooling often requested during vishing or fake IT support.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(quickassist|anydesk|teamviewer|screenconnect|connectwise|splashtop|logmein|ammyy|rustdesk)'
   OR CommandLine =~ '(?i)(quickassist|anydesk|teamviewer|screenconnect|connectwise|splashtop|logmein|rustdesk)'

-- Recent executables in user-writable locations that frequently follow a social engineering handoff.
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/Downloads/*.exe','C:/Users/*/Downloads/*.msi','C:/Users/*/AppData/Local/Temp/*.exe','C:/ProgramData/*/AnyDesk/*.exe'])
WHERE Mtime > now() - 1209600

# Read-only audit for Entra ID and Exchange artifacts commonly seen after help desk or MFA social engineering.
# Run with least-privilege Graph scopes first: AuditLog.Read.All, UserAuthenticationMethod.Read.All, Policy.Read.All, Directory.Read.All.
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
Connect-MgGraph -Scopes 'AuditLog.Read.All','UserAuthenticationMethod.Read.All','Policy.Read.All','Directory.Read.All' -NoWelcome
$start = (Get-Date).AddDays(-14)

# Risky users and recent risky sign-ins
$riskyUsers = Get-MgRiskyUser -All | Where-Object { $_.RiskLastUpdatedDateTime -ge $start }
$riskySignIns = Get-MgAuditLogSignIn -All | Where-Object { $_.CreatedDateTime -ge $start -and ($_.RiskLevelDuringSignIn -in @('medium','high')) }
$riskyUsers | Select-Object UserPrincipalName,RiskState,RiskLevel,RiskLastUpdatedDateTime | Export-Csv .\audit-risky-users.csv -NoTypeInformation
$riskySignIns | Select-Object CreatedDateTime,UserPrincipalName,AppDisplayName,IpAddress,Location,RiskLevelDuringSignIn,Status | Export-Csv .\audit-risky-signins.csv -NoTypeInformation

# Recently changed authentication methods for targeted users
foreach ($u in ($riskySignIns | Select-Object -ExpandProperty UserPrincipalName -Unique)) {
  Get-MgUserAuthenticationMethod -UserId $u -ErrorAction SilentlyContinue |
    Select-Object @{n='User';e={$u}},Id,CreatedDateTime,
      @{n='Type';e={$_.AdditionalProperties.'@odata.type'}} |
    Export-Csv .\audit-auth-methods.csv -Append -NoTypeInformation
}

# Recent app registrations and consent events
Get-MgAuditLogDirectoryAudit -All |
  Where-Object { $_.ActivityDateTime -ge $start -and $_.ActivityDisplayName -match 'Consent to application|Add service principal credentials|Add application|Add owner to application' } |
  Select-Object ActivityDateTime,ActivityDisplayName,InitiatedBy,TargetResources |
  Export-Csv .\audit-app-consent.csv -NoTypeInformation

# Exchange inbox forwarding or deletion rules, if Exchange Online module is available
if (Get-Module -ListAvailable ExchangeOnlineManagement) {
  Connect-ExchangeOnline -ShowBanner:$false
  Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
      Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.DeleteMessage -eq $true } |
      Select-Object MailboxOwnerId,Name,ForwardTo,RedirectTo,DeleteMessage,Description
  } | Export-Csv .\audit-inbox-rules.csv -NoTypeInformation
}