Storm-0940 ConnectWise Supply Chain Compromise: Detecting and Remediating ARTEX-Driven Microsoft 365 Credential Abuse

---
title: Entra ID Application Credential Added to App Registration or Service Principal
id: 8c2f4a61-3b9d-4e17-a5c2-9f1d7e4b6a03
status: experimental
description: Detects addition of client secrets or certificates to Entra ID applications/service principals, a persistence technique used by Storm-0940 in the ConnectWise supply chain campaign. Triage all hits immediately; correlate actor identity against approved change windows.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  - https://attack.mitre.org/techniques/T1098/001/
  - https://attack.mitre.org/techniques/T1550/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1098.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Add service principal credentials'
      - 'Add application credentials'
      - 'Update application – Certificates and secrets management'
      - 'Consent to application'
    result: 'success'
falsepositives:
  - Legitimate application onboarding or secret rotation by app owners — baseline and alert on deviation
level: high
---
title: ConnectWise ScreenConnect or Automate Spawning Shell or Scripting Child Processes
id: 3e7b9c24-6a1f-4d58-b2e7-8c4a1f9d5e62
status: experimental
description: Detects ConnectWise remote access/management components spawning command shells, PowerShell, or script interpreters. Storm-0940 leveraged ConnectWise channels for downstream execution; legitimate ScreenConnect sessions launching interactive shells outside approved maintenance windows are high-fidelity for hands-on or agentic abuse.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.command_and_control
  - attack.execution
  - attack.t1219
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\ScreenConnect'
      - '\ConnectWiseControl'
      - '\ConnectWiseAutomate'
      - 'ScreenConnect.ClientService.exe'
      - 'ScreenConnect.WindowsClient.exe'
      - 'LTAgent.exe'
      - 'ltsvcmon.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - MSP technicians running interactive remediation sessions — whitelist by scheduled session metadata, not by parent process alone
level: high
---
title: New Service Principal Created Followed by Privileged Role Assignment
id: 5f1a8d73-2c6e-4b49-9d31-7e5c2a8f4b19
status: experimental
description: Detects creation of a new service principal or app registration followed by directory role or app role assignment, a pattern consistent with Storm-0940 establishing durable application-based persistence in compromised M365 tenants.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Add service principal'
      - 'Add application'
      - 'Add app role assignment to service principal'
      - 'Add member to role'
    result: 'success'
falsepositives:
  - DevOps pipelines provisioning applications — alert on actor accounts outside known automation identities
level: medium

// Hunt 1: Application credential additions on app registrations / service principals
// Core Storm-0940 persistence. Correlate actor UPN/IP against approved changes.
AuditLog
| where TimeGenerated > ago(30d)
| where OperationName in~ (
    "Add service principal credentials",
    "Update application – Certificates and secrets management",
    "Consent to application")
| where Result == "success"
| mv-expand TargetResources
| extend AppDisplayName = tostring(TargetResources.displayName)
| extend ModifiedProps = TargetResources.modifiedProperties
| mv-expand InitiatedBy__ = InitiatedBy
| extend ActorUpn = tostring(parse_json(tostring(InitiatedBy__.user)).userPrincipalName)
| extend ActorIp = tostring(parse_json(tostring(InitiatedBy__.user)).ipAddress)
| project TimeGenerated, OperationName, AppDisplayName, ActorUpn, ActorIp, CorrelationId, ModifiedProps
| order by TimeGenerated desc
;

// Hunt 2: Service principal sign-ins from anomalous ASNs or first-seen IPs
// Client-credentials abuse authenticates as the app — look here, not just user sign-ins.
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(14d)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            IPs = make_set(IPAddress), Locations = make_set(Location)
    by ServicePrincipalName, AppId
| where array_length(IPs) > 2 or FirstSeen > ago(3d)
| order by FirstSeen desc
;

// Hunt 3: ConnectWise components spawning shells on endpoints
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (
    "ScreenConnect", "ConnectWiseControl", "LTAgent", "ltsvcmon")
| where FileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe",
    "wscript.exe", "cscript.exe", "rundll32.exe", "wmic.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

-- Hunt for ConnectWise remote access components spawning shells or scripting engines
-- across the fleet. Deploy as a hunt; export results for timeline correlation
-- against Entra ID audit events in the same window.
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)ScreenConnect|ConnectWiseControl|LTAgent|ltsvcmon'
   AND CommandLine =~ '(?i)cmd\.exe|powershell|pwsh|mshta|wscript|cscript|rundll32|wmic')
   OR Name =~ '(?i)^(cmd|powershell|pwsh|mshta|wscript|cscript)\.exe$'
      AND CommandLine =~ '(?i)connectwise|screenconnect'

# Storm-0940 / ARTEX Campaign - M365 Application Credential Audit & Containment
# Requires: Microsoft.Graph PowerShell SDK
# Run as: identity with Application.Read.All, AuditLog.Read.All, Directory.Read.All

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All","Directory.Read.All" -NoWelcome
$cutoff = (Get-Date).AddDays(-45)
$report = [System.Collections.Generic.List[object]]::new()

# 1) Enumerate all applications and their credential material
$apps = Get-MgApplication -All -Property Id,AppId,DisplayName,KeyCredentials,PasswordCredentials,CreatedDateTime
foreach ($app in $apps) {
    foreach ($kc in $app.KeyCredentials) {
        $report.Add([pscustomobject]@{
            AppName = $app.DisplayName; AppId = $app.AppId
            CredType = "Certificate"; CreatedOn = $kc.StartDateTime
            ExpiresOn = $kc.EndDateTime; KeyId = $kc.KeyId
            RecentCredential = ($kc.StartDateTime -gt $cutoff)
        })
    }
    foreach ($pc in $app.PasswordCredentials) {
        $report.Add([pscustomobject]@{
            AppName = $app.DisplayName; AppId = $app.AppId
            CredType = "ClientSecret"; CreatedOn = $pc.StartDateTime
            ExpiresOn = $pc.EndDateTime; KeyId = $pc.KeyId
            RecentCredential = ($pc.StartDateTime -gt $cutoff)
        })
    }
}

# 2) Pull audit events for credential manipulation in the window
$events = Get-MgAuditLogDirectoryAudit -All -Filter "activityDateTime ge $($cutoff.ToString('o'))" |
  Where-Object { $_.ActivityDisplayName -match 'credentials|Certificates and secrets|Consent to application' } |
  Select-Object ActivityDateTime, ActivityDisplayName,
    @{n='Actor';e={ $_.InitiatedBy.user.userPrincipalName }},
    @{n='ActorIp';e={ $_.InitiatedBy.user.ipAddress }},
    @{n='Target';e={ ($_.TargetResources | Select-Object -First 1).displayName }}

# 3) Export findings - review EVERY RecentCredential=$true row and every audit actor
$report | Sort-Object RecentCredential -Descending | Export-Csv .\M365_AppCred_Audit.csv -NoTypeInformation
$events | Export-Csv .\M365_AppCred_AuditEvents.csv -NoTypeInformation
Write-Host "[+] $($report.Count) credentials enumerated across $($apps.Count) apps." -ForegroundColor Cyan
Write-Host "[!] REVIEW REQUIRED: $(($report | Where-Object RecentCredential).Count) credentials created since $($cutoff.ToShortDateString())." -ForegroundColor Yellow
Write-Host "[i] Cross-reference .\M365_AppCred_AuditEvents.csv actors against approved change records." -ForegroundColor Cyan

# 4) CONTAINMENT (uncomment ONLY after IR approval - removes a confirmed rogue secret):
# $badApp = Get-MgApplicationByAppId -AppId "<CONFIRMED-MALICIOUS-APP-ID>"
# Remove-MgApplicationPassword -ApplicationId $badApp.Id -KeyId "<ROGUE-KEY-ID>"
# For rogue certificates: Remove-MgApplicationKey -ApplicationId $badApp.Id -KeyId "<ROGUE-KEY-ID>" -BodyParameter @{Proof="<jwt>"}

Disconnect-MgGraph