ConnectWise (SkyKick) Abuse: Sign-ins from Known Attacker IPs
Detects Entra sign-ins from infrastructure tied to the ConnectWise Cloud Backup (SkyKick) credential abuse: 144.172.64[.]128 (Huntress), plus 144.172.64[.]99 and 144.172.64[.]60 (ConnectWise advisory, Oct 18). Covers service principal sign-ins and user sign-ins, which captures the Oct 13-14 password spray. A success means a token was issued, so treat it as an incident. Failures still show targeting.
Microsoft Sentinel (KQL)
