UNC6671 Vishing Campaign Targets Personal Phones to Bypass MFA and Steal SaaS Data — Detection and Hardening Guide

---
title: Remote Access Tool Installation During Suspected Vishing Window
id: 9c2e4a71-3f58-4b6d-a1e7-8d2c5f9a3b41
status: experimental
description: Detects installation or execution of remote access tools (AnyDesk, ScreenConnect, TeamViewer, Splashtop, LogMeIn) commonly deployed during help desk impersonation / vishing intrusions where attackers instruct victims to install 'migration support software'.
references:
  - https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\Splashtop.exe'
      - '\SRManager.exe'
      - '\LMIGuardianSvc.exe'
      - '\GoToAssist*.exe'
      - '\ZohoMeeting*.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Downloads\'
  condition: selection_image or selection_path
falsepositives:
  - Organizations with sanctioned RMM deployments — baseline approved tools and paths, alert on everything else
  - Legitimate IT remote support sessions
level: high
---
title: MFA Credential or Authenticator Method Modified Via PowerShell or Graph API
id: 4b1d8f62-7a3c-4e95-b2d8-6f1a9c4e7d35
status: experimental
description: Detects local modification of MFA-related configuration or suspicious use of credential management utilities that may follow session token theft in AiTM phishing intrusions.
references:
  - https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html
  - https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1556
  - attack.t1555
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'vaultcmd'
      - 'rundll32.exe keymgr.dll'
      - 'cmdkey /list'
      - 'Microsoft.AAD.BrokerPlugin'
      - 'TokenBroker'
  condition: selection
falsepositives:
  - Rare legitimate credential administration; investigate context and user
level: medium
---
title: Browser Cookie and Session Store Access by Non-Browser Process
id: 7e5c3a94-1d68-4f27-9b3a-2c8e6d4f1a92
status: experimental
description: Detects non-browser processes accessing browser cookie/session databases, a technique used to extract cloud session tokens after credential theft for replay against SaaS platforms.
references:
  - https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1539
logsource:
  category: file_access
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Cookies'
      - '\Login Data'
      - '\Local State'
      - '\Network\Cookies'
  selection_path:
    TargetFilename|contains:
      - '\Google\Chrome\'
      - '\Microsoft\Edge\'
      - '\Mozilla\Firefox\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\msmpeng.exe'
  condition: selection_target and selection_path and not filter_browsers
falsepositives:
  - Backup and sync agents; EDR telemetry collectors — baseline and exclude known-good
level: high

// Hunt 1: MFA method change or new device registration followed by risky SaaS sign-in within 24h
// Tables: AuditLogs + SigninLogs (Sentinel) — adjust for AADNonInteractiveUserSignInLogs as needed
let mfaEvents =
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any ("Add authentication method", "Update user", "Add service principal credentials", "Add registered device")
| where tostring(TargetResources[0].displayName) != ""
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend ModifiedProps = tostring(TargetResources[0].modifiedProperties)
| where ModifiedProps has_any ("StrongAuthentication", "Phone", "Authenticator", "Device")
| project MFAChangeTime=TimeGenerated, TargetUser, Actor, OperationName, CorrelationId;
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| join kind=inner mfaEvents on $left.UserPrincipalName == $right.TargetUser
| where TimeGenerated between (MFAChangeTime .. MFAChangeTime + 24h)
| extend NewLocation = iif(isempty(Location), "Unknown", Location)
| summarize FirstSignIn=min(TimeGenerated), SignInCount=count(), Locations=make_set(NewLocation), IPs=make_set(IPAddress), Apps=make_set(AppDisplayName)
    by UserPrincipalName, Actor, OperationName, MFAChangeTime
| project UserPrincipalName, OperationName, Actor, MFAChangeTime, FirstSignIn, SignInCount, Locations, IPs, Apps
| sort by MFAChangeTime desc;

// Hunt 2: Endpoint execution of remote access tools (vishing 'migration software')
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("AnyDesk.exe", "ScreenConnect.ClientService.exe", "TeamViewer.exe", "Splashtop.exe", "GoToAssist", "ZohoMeeting")
   or ProcessCommandLine has_any ("anydesk", "screenconnect", "teamviewer")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), CommandLines=make_set(ProcessCommandLine)
    by DeviceName, FileName, InitiatingProcessAccountName, InitiatingProcessFileName
| sort by FirstSeen desc;

// Hunt 3: Impossible travel / unfamiliar ASN sign-ins to SaaS apps (AiTM proxy replay indicator)
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where AppDisplayName has_any ("Office 365", "SharePoint", "Exchange", "Salesforce", "Google", "Workday", "Okta")
| summarize Locations=make_set(Location), Countries=make_set(tostring(LocationDetails.countryOrRegion)), ASNs=make_set(tostring(NetworkLocationDetails)), IPs=make_set(IPAddress)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Countries) > 1
| project UserPrincipalName, TimeGenerated, Countries, IPs, ASNs
| sort by TimeGenerated desc;

-- Hunt for remote access tooling and browser session store access indicative of
-- vishing-driven intrusion persistence (UNC6671-style help desk impersonation)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(anydesk|screenconnect|teamviewer|splashtop|gotoassist|zohoassist|logmein)'
   OR Exe =~ '(?i)(anydesk|screenconnect|teamviewer|splashtop|gotoassist)'
   OR CommandLine =~ '(?i)(anydesk|screenconnect|teamviewer)'

-- Enumerate recently created RMM executables in user-writable paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/*AnyDesk*.exe',
  'C:/Users/*/Downloads/*ScreenConnect*.exe',
  'C:/Users/*/Downloads/*TeamViewer*.exe',
  'C:/Users/*/AppData/**/*AnyDesk*.exe',
  'C:/Users/Public/**/*ScreenConnect*.exe'
])
ORDER BY Ctime DESC

# UNC6671 Vishing Response: Audit recent MFA method changes and flag high-risk accounts
# Requires: Microsoft.Graph PowerShell SDK (Identity.SignIns scope: AuditLog.Read.All, Directory.Read.All)
# Run as: Global Reader or Security Reader minimum

Import-Module Microsoft.Graph.Identity.SignIns -ErrorAction Stop
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","UserAuthenticationMethod.Read.All" -NoWelcome

$lookback = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")

# 1. Find recent MFA/authentication method changes in the directory audit log
Write-Host "`n=== Recent Authentication Method Changes (last 7 days) ===" -ForegroundColor Cyan
$auditEvents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $lookback" -All |
    Where-Object { $_.ActivityDisplayName -match "authentication method|registered device|strongAuthentication" }

$auditEvents | ForEach-Object {
    $target = $_.TargetResources[0].UserPrincipalName
    $actor  = if ($_.InitiatedBy.User) { $_.InitiatedBy.User.UserPrincipalName } else { $_.InitiatedBy.App.DisplayName }
    [PSCustomObject]@{
        Time      = $_.ActivityDateTime
        Activity  = $_.ActivityDisplayName
        Actor     = $actor
        Target    = $target
        Result    = $_.Result
    }
} | Format-Table -AutoSize

# 2. For each account with a recent change, enumerate current auth methods to spot attacker-registered factors
Write-Host "`n=== Auth Methods on Changed Accounts (verify each is user-recognized) ===" -ForegroundColor Cyan
$changedUsers = $auditEvents | ForEach-Object { $_.TargetResources[0].UserPrincipalName } | Sort-Object -Unique
foreach ($u in $changedUsers) {
    if ([string]::IsNullOrWhiteSpace($u)) { continue }
    try {
        $methods = Get-MgUserAuthenticationMethod -UserId $u -ErrorAction Stop
        foreach ($m in $methods) {
            [PSCustomObject]@{
                User       = $u
                MethodType = $m.AdditionalProperties.'@odata.type'
                Detail     = ($m.AdditionalProperties | ConvertTo-Json -Compress -Depth 3)
            }
        }
    } catch {
        Write-Warning "Could not enumerate methods for $u : $_"
    }
}

# 3. Verify phishing-resistant MFA coverage: list users with ONLY phone/SMS methods (highest vishing risk)
Write-Host "`n=== Users Lacking Phishing-Resistant MFA (FIDO2/Windows Hello/CBA) ===" -ForegroundColor Cyan
$report = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
$report | Where-Object {
    $_.IsMfaRegistered -eq $true -and
    ($_.MethodsRegistered -notmatch "fido2|windowsHelloForBusiness|certificateBasedAuthentication|passkey")
} | Select-Object UserPrincipalName, MethodsRegistered, IsMfaCapable | Format-Table -AutoSize

Write-Host "`nAction: Any MFA change NOT confirmed with the user via a verified callback = treat as compromised. Revoke sessions, remove rogue methods, reset credentials." -ForegroundColor Yellow
Disconnect-MgGraph