S
Shawn Sailer
Huntress has confirmed unauthorized access tied to ConnectWise Cloud Backup (formerly SkyKick Backup) and the ConnectWise Cloud Management apps. Per Huntress, the Cloud Management apps self-assigned directory roles (mostly Exchange Administrator, Global Administrator in one tenant) and added client secrets to other apps. Huntress recommends DISABLING the apps, not deleting them, because deleting removes consent. The apps were renamed, so searching by the SkyKick name can miss them; these metrics match on Application ID, with a name fallback for older tenants. Finding an app does not mean a tenant was accessed, but it does mean the app is installed and should be reviewed.
App IDs covered:
ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
Metric 6: Microsoft 365: ConnectWise Cloud Backup and Cloud Management Apps Present
Description: Lists installed ConnectWise Cloud Backup (formerly SkyKick) and Cloud Management apps with enabled state. Matches by Application ID, with a name fallback.
Query:
ServicePrincipals[?contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')].{App: displayName, Publisher: publisherName, AppId: appId, Enabled: accountEnabled, Created: createdDateTime}
Metric 7: Microsoft 365: Count of ConnectWise Cloud Apps Present
Description: Count of ConnectWise Cloud Backup and Cloud Management apps present in any state. Alert above 0.
Query:
length(ServicePrincipals[?contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')] || `[]`)
Metric 8: Microsoft 365: Count of Enabled ConnectWise Cloud Apps
Description: Count of ConnectWise Cloud Backup and Cloud Management apps that are still enabled. Alert above 0, then disable (don't delete) the apps.
Query:
length(ServicePrincipals[?(contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')) && accountEnabled==`true`] || `[]`)
What to do: alert on a count above 0, then disable the apps in Entra (Enterprise applications > Properties > Enabled for users to sign-in? set to No). Do not delete them, and do not re-enable them until ConnectWise confirms credentials have been reset. Disabling does not remove credentials that were already added to other apps, so also review credentials and role assignments in each affected tenant (see the related metrics in this library). Follow Huntress and ConnectWise for current guidance.