Metrics Library

Huntress has confirmed unauthorized access tied to ConnectWise Cloud Backup (formerly SkyKick Backup) and the ConnectWise Cloud Management apps. Per Huntress, the Cloud Management apps self-assigned directory roles (mostly Exchange Administrator, Global Administrator in one tenant) and added client secrets to other apps. Huntress recommends DISABLING the apps, not deleting them, because deleting removes consent. The apps were renamed, so searching by the SkyKick name can miss them; these metrics match on Application ID, with a name fallback for older tenants. Finding an app does not mean a tenant was accessed, but it does mean the app is installed and should be reviewed. App IDs covered: ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83 Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640 Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519 Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827 Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb Metric 6: Microsoft 365: ConnectWise Cloud Backup and Cloud Management Apps Present Description: Lists installed ConnectWise Cloud Backup (formerly SkyKick) and Cloud Management apps with enabled state. Matches by Application ID, with a name fallback. Query: ServicePrincipals[?contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')].{App: displayName, Publisher: publisherName, AppId: appId, Enabled: accountEnabled, Created: createdDateTime} Metric 7: Microsoft 365: Count of ConnectWise Cloud Apps Present Description: Count of ConnectWise Cloud Backup and Cloud Management apps present in any state. Alert above 0. Query: length(ServicePrincipals[?contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')] || `[]`) Metric 8: Microsoft 365: Count of Enabled ConnectWise Cloud Apps Description: Count of ConnectWise Cloud Backup and Cloud Management apps that are still enabled. Alert above 0, then disable (don't delete) the apps. Query: length(ServicePrincipals[?(contains(['506e08f9-6e9a-4da4-942b-a099a03644ae','2399d300-6fca-4e6a-a686-399fefe75b83','24205314-2b89-4e07-a2a4-579e898a5640','b78f6a77-d4e5-46fb-87e5-d1648bd02519','0de14c77-b9b0-4137-9360-34878a929827','412dcf96-176d-4b3a-a1b0-4981ad66971e','b2b55f5b-7758-4719-8d8f-88ae172e6bdb'], appId || '') || contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud') || contains(publisherName || '', 'ConnectWise S-K')) && accountEnabled==`true`] || `[]`) What to do: alert on a count above 0, then disable the apps in Entra (Enterprise applications > Properties > Enabled for users to sign-in? set to No). Do not delete them, and do not re-enable them until ConnectWise confirms credentials have been reset. Disabling does not remove credentials that were already added to other apps, so also review credentials and role assignments in each affected tenant (see the related metrics in this library). Follow Huntress and ConnectWise for current guidance.

Huntress reports that the compromised ConnectWise Cloud Management apps assigned themselves directory roles in affected tenants, mostly Exchange Administrator and Global Administrator in one tenant. Disabling the apps does not remove a role assignment, so check which roles they hold. This metric lists directory roles that have a ConnectWise Cloud or SkyKick service principal as a member. Role members are matched by display name because role membership does not include the Application ID. A match doesn't mean a tenant was accessed, but any ConnectWise or SkyKick app holding a role should be reviewed immediately. Metric 1: Microsoft 365: ConnectWise or SkyKick Apps Holding Directory Roles Description: Lists directory roles held by a ConnectWise Cloud or SkyKick service principal. Alert above 0, then review in the Entra audit log and disable (don't delete) the app. Query: Roles[?Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))]].{Role: displayName, Apps: Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))].displayName} Metric 2: Microsoft 365: Count of ConnectWise or SkyKick Apps Holding Directory Roles Description: Count of directory roles held by a ConnectWise Cloud or SkyKick service principal. Alert above 0, then review in the Entra audit log and disable (don't delete) the app. Query: length(Roles[?Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))]] || `[]`) Metric 3: Microsoft 365: Service Principals Holding Directory Roles Description: Lists all service principals (apps) holding any directory role. Use to review non-human role assignments. Query: Roles[?Members[?isServicePrincipal==`true`]].{Role: displayName, ServicePrincipals: Members[?isServicePrincipal==`true`].displayName} What to do: alert on a count above 0. Review when each role was assigned using the Entra audit log (Add member to role), remove the assignment if it is unexpected, and disable the app rather than deleting it. Do not re-enable it until ConnectWise confirms credentials have been reset. Follow Huntress and ConnectWise for current guidance.

Huntress reports that the compromised ConnectWise Cloud Management apps added client secrets to other applications in affected tenants, including a Huntress app. Disabling the ConnectWise apps does not remove credentials that were already added, so each tenant needs a separate credential review. This metric lists app registrations that have had a client secret or certificate added in the last 30 days, with a count of each, so you can spot credentials nobody on your team created. Expect some benign matches, such as Microsoft Entra Connect Sync rotating its certificate. Review each result against your own change records. A match doesn't mean a tenant was accessed. Metric 4: Microsoft 365: App Registrations With Recently Added Credentials Description: Lists app registrations with a client secret or certificate added in the last 30 days. Some matches are benign (e.g. Entra Connect Sync certificate rotation), so verify against change records. Query: Applications[?passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || keyCredentials[?time_until(startDateTime, `days`) >= `-30`]].{App: displayName, AppId: appId, SecretsAdded: length(passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || `[]`), CertificatesAdded: length(keyCredentials[?time_until(startDateTime, `days`) >= `-30`] || `[]`)} Metric 5: Microsoft 365: Count of App Registrations With Recently Added Credentials Description: Count of app registrations with a client secret or certificate added in the last 30 days. Alert above 0. Query: length(Applications[?passwordCredentials[?time_until(startDateTime, `days`) >= `-30`] || keyCredentials[?time_until(startDateTime, `days`) >= `-30`]] || `[]`) What to do: for each result, confirm someone on your team added the credential. Remove any secret or certificate you can't account for, and check the app's owners and permissions. Change the 30 in both queries to widen or narrow the window. Follow Huntress and ConnectWise for current guidance.

Using the software AppID's from the Huntress Rouge Apps page, I created this metric to detect the following potentially malicious Microsoft 365 Apps: eM Client PerfectData Software Newsletter Software Supermailer rclone CloudSponge SigParser Mail_Backup ServicePrincipals[?contains( ["e9a7fea1-1cc0-4cd9-a31b-9137ca5deedd", "ff8d92dc-3d82-41d6-bcbd-b9174d163620", "a245e8c0-b53c-4b67-9b45-751d1dff8e6b", "b15665d9-eda6-4092-8539-0eec376afd59", "a43e5392-f48b-46a4-a0f1-098b5eeb4757", "caffae8c-0882-4c81-9a27-d1803af53a40", "2ef68ccc-8a4d-42ff-ae88-2d7bb89ad139"] , appId)].[appDisplayName, join( : , [``, to_string(createdDateTime)])]

Microsoft starts disabling EWS tenant by tenant on October 1, 2026, and finishes in April 2027. Any tenant that never explicitly set the EWS setting is switched off automatically. This metric lists every app in the tenant that has been granted an EWS permission. Backup, security, and mail tools that still depend on EWS may stop working when a tenant is switched off. Holding the permission doesn't prove an app still calls EWS, so check with the vendor. This metric doesn't cover user mail clients like Apple Mail or Outlook Classic. What is EWS? Exchange Web Services (EWS) is Microsoft's older API that apps use to read and manage Exchange mailbox data, such as email, calendars, and contacts. Many backup, security, and mail tools still depend on it, and it stops working in a tenant once Microsoft disables it. Microsoft's EWS deprecation details → https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online List query: EnterpriseAppConsentPermissions[?claimValue=='full_access_as_app' || claimValue=='EWS.AccessAsUser.All'].{App: enterpriseApplicationName, Publisher: applicationPublisher, AppId: applicationId, Permission: claimValue, Type: type, GrantedThrough: grantedThrough} Count query (for alerting): length(EnterpriseAppConsentPermissions[?claimValue=='full_access_as_app' || claimValue=='EWS.AccessAsUser.All'])

Devices[?operatingSystem == Windows && accountEnabled == true && operatingSystemVersion >= 10.0.19041 && operatingSystemVersion <= 10.0.19045.4412 && approximateLastSignInDateTime != null && time_since(approximateLastSignInDateTime, days )< 30 ].[displayName, operatingSystemVersion, approximateLastSignInDateTime] | sort_by(@, &[0])

The metric query is designed to provide the percentage of total drive storage consumed by each tenant within Microsoft 365. This allows administrators to monitor and analyze storage usage across different tenants, helping to identify which tenants are utilizing the most storage resources. By using this query, you can gain valuable insights into storage consumption patterns, optimize resource allocation, and ensure that storage limits are managed effectively. `` percent_of(sum(drives[].quota.used), sum(drives[].quota.total)) ``

The metric query is designed to provide the percentage of total drive storage remaining for each tenant within Microsoft 365. This allows administrators to monitor storage usage effectively across different tenants, helping to ensure that storage limits are not exceeded and that there is sufficient space available for ongoing operations. By using this query, you can gain valuable insights into storage consumption patterns, identify tenants that may be approaching their storage capacity, and take proactive measures to manage resources efficiently. `` percent_of(sum(drives[].quota.remaining), sum(drives[].quota.total)) ``

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired. Applications[?passwordCredentials[?time_until(endDateTime, days ) < 30 ].endDateTime].['Application Name: 'displayName, 'Secret Name: 'passwordCredentials[?time_until(endDateTime, days ) < 30 ].displayName]

This will look for users with mailboxes larger than 45. Customize the value to change Metric. Output will include mailname and size of mailbox. Users[?Storage_Used >'45'].join( : , [mail,to_string(Storage_Used)])