Inferlume

title: Unauthorized ConnectWise Service Principal Sign In From Known Adversary IP
id: c4e8b2a1-7d3f-4e92-b816-f308945a192b
status: experimental
description: Detects Microsoft Entra ID service principal sign ins associated with ConnectWise application identities originating from documented adversary IP infrastructure.
references:
    - hxxps://www.connectwise[.]com/company/trust/advisories
author: CTI Detection Engineering
date: 2026-10-19
logsource:
    service: signinlogs
    product: azure
detection:
    selection_apps:
        AppId:
            - '506e08f9-6e9a-4da4-942b-a099a03644ae'
            - '24205314-2b89-4e07-a2a4-579e898a5640'
            - '239d300-6fca-4e6a-a686-399fefe75b83'
            - 'b78f6a77-d4e5-46fb-87e5-d1648bd02519'
            - '0de14c77-b9b0-4137-9360-34878a929827'
            - '412dcf96-176d-4b1a-4da4-942b-a099a03644ae'
            - 'b2b55f5b-7758-4719-8d8f-88ae172e6bdb'
    selection_network:
        IPAddress:
            - '144.172.64.128'
            - '144.172.64.99'
            - '144.172.64.60'
    condition: selection_apps or selection_network
falsepositives:
    - Highly unlikely unless IP addresses are legitimately reassigned to corporate infrastructure.
level: critical
tags:
    - attack.initial_access
    - attack.t1199
    - attack.t1078.004

rule Backdoor_Linux_ARMORYCASTLE_BARECLAW {
    meta:
        description = "Detects BARECLAW SOCKS5 WebSocket tunneling utility deployed by ARMORY CASTLE"
        author = "CTI Detection Engineering"
        date = "2026-10-19"
        severity = "CRITICAL"
        reference = "BT26-05-Analysis"
    strings:
        $s1 = "[%s ws_socks5d] " ascii wide
        $s2 = "--obfs requires --token" ascii wide
        $s3 = "mux: %s (frame[%lu]: %s)" ascii wide
        $s4 = "cannot create stream pump/writer thread" ascii wide
        $s5 = "--ws-path must start with '/'" ascii wide
        $b_xorshift = { 48 c1 e0 17 48 31 c1 48 89 f0 48 c1 e8 1a 48 31 f0 48 31 c8 48 c1 e9 11 48 31 c8 }
    condition:
        uint32(0) == 0x464c457f and (3 of ($s*) or $b_xorshift)
}

rule Webshell_PHP_ARMORYCASTLE_SAWFLY {
    meta:
        description = "Detects SAWFLY obfuscated PHP webshell deployed on BeyondTrust appliances"
        author = "CTI Detection Engineering"
        date = "2026-10-19"
        severity = "CRITICAL"
    strings:
        $param = "_c94mfe" ascii wide
        $b32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" ascii wide
        $rc4 = "range(0,255)" ascii wide
        $eval = "@eval(" ascii wide
        $code404 = "http_response_code(404)" ascii wide
    condition:
        filesize < 25KB and all of them
}

rule Infostealer_GhostAction_FakeFont_Payload {
    meta:
        description = "Identifies executable binaries masquerading as font files in developer repositories"
        author = "CTI Detection Engineering"
        date = "2026-10-19"
        severity = "HIGH"
    strings:
        $magic_pe = { 4D 5A }
        $magic_elf = { 7F 45 4C 46 }
        $tok1 = "api.anthropic.com" ascii wide
        $tok2 = "generativelanguage.googleapis.com" ascii wide
        $tok3 = "/.aws/credentials" ascii wide
        $tok4 = "/.kube/config" ascii wide
        $font_name = "fa-solid-400.woff2" ascii wide
    condition:
        ($magic_pe at 0 or $magic_elf at 0) and 2 of ($tok1, $tok2, $tok3, $tok4, $font_name)
}

// Hunt for unauthorized service principal operations across Microsoft 365 services
AADServicePrincipalSignInLogs
| where TimeGenerated >= ago(14d)
| where AppId in (
    "506e08f9-6e9a-4da4-942b-a099a03644ae",
    "24205314-2b89-4e07-a2a4-579e898a5640",
    "239d300-6fca-4e6a-a686-399fefe75b83",
    "b78f6a77-d4e5-46fb-87e5-d1648bd02519",
    "0de14c77-b9b0-4137-9360-34878a929827",
    "412dcf96-176d-4b1a-4da4-942b-a099a03644ae",
    "b2b55f5b-7758-4719-8d8f-88ae172e6bdb"
  )
| where IPAddress in ("144.172.64.128", "144.172.64.99", "144.172.64.60") or Location !in ("ApprovedCorporateLocations")
| project TimeGenerated, AppId, ServicePrincipalName, IPAddress, Location, ResourceDisplayName, ResultType, CorrelationId

// Hunt for mailbox manipulation or mass file access following service principal authentication
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType in ("New-InboxRule", "Set-Mailbox", "Add-MailboxPermission", "FileDownloaded", "MailItemsAccessed")
| where RawEventData has_any ("506e08f9-6e9a-4da4-942b-a099a03644ae", "24205314-2b89-4e07-a2a4-579e898a5640")
| project TimeGenerated, AccountDisplayName, ActionType, IPAddress, RawEventData