S
Shawn Sailer
Huntress reports that the compromised ConnectWise Cloud Management apps added client secrets to other applications in affected tenants, including a Huntress app. Disabling the ConnectWise apps does not remove credentials that were already added, so each tenant needs a separate credential review. This metric lists app registrations that have had a client secret or certificate added in the last 30 days, with a count of each, so you can spot credentials nobody on your team created. Expect some benign matches, such as Microsoft Entra Connect Sync rotating its certificate. Review each result against your own change records. A match doesn't mean a tenant was accessed.
Metric 4: Microsoft 365: App Registrations With Recently Added Credentials
Description: Lists app registrations with a client secret or certificate added in the last 30 days. Some matches are benign (e.g. Entra Connect Sync certificate rotation), so verify against change records.
Query:
Applications[?passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || keyCredentials[?time_until(startDateTime, `days`) >= `-30`]].{App: displayName, AppId: appId, SecretsAdded: length(passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || `[]`), CertificatesAdded: length(keyCredentials[?time_until(startDateTime, `days`) >= `-30`] || `[]`)}
Metric 5: Microsoft 365: Count of App Registrations With Recently Added Credentials
Description: Count of app registrations with a client secret or certificate added in the last 30 days. Alert above 0.
Query:
length(Applications[?passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || keyCredentials[?time_until(startDateTime, `days`) >= `-30`]] || `[]`)
What to do: for each result, confirm someone on your team added the credential. Remove any secret or certificate you can't account for, and check the app's owners and permissions. Change the 30 in both queries to widen or narrow the window. Follow Huntress and ConnectWise for current guidance.