ConnectWise Service Principal Mass Tenant Enumeration
Detects specific ConnectWise application service principals signing into a large number of resource tenants within a short window, or utilizing known suspicious/scripted user agents and infrastructure IPs associated with supply chain compromise activity.
Microsoft Sentinel (KQL)
