Storm-2949 -- Azure management-plane credential harvesting after SSPR-abuse account takeover (2026-05-18)
SIGMA detection rule by WinstonRedGuard -- sigma plugin observed rules (derived from breach corpus) · Unknown
Real, actively-tracked cloud-identity campaign disclosed by Microsoft Threat Intelligence on 2026-05-18 (Storm-2949 -- temporary designation, not yet attributed to a named actor), cross-verified against independent secondary write-ups (SC Media, TheCyberExpress, SOCPrime, Specops).
Confirmed by BOTH the primary source and at least one independent source: initial access via abuse of Microsoft Entra ID's Self-Service Password Reset (SSPR) flow -- the actor initiates an SSPR request against a targeted account and social-engineers the victim (posing as internal IT support) into approving the resulting MFA prompt, letting the actor reset the password and strip existing authentication methods, eliminating MFA as a control. The actor then uses the Microsoft Graph API plus custom Python (Azure SDK) scripts to enumerate users, roles, service principals, and applications, searches OneDrive/SharePoint for IT-ops files and VPN configs, and installs ScreenConnect (renamed to resemble a legitimate Windows component per the independent write-ups, exact string not disclosed) for persistent remote access.
This rule targets the credential-harvesting stage, using the exact Azure Resource Manager operation names published directly in Microsoft's own advisory: publishing-profile retrieval (publishxml/action, which returns FTP/WebDeploy cleartext credentials), SQL server firewall-rule creation (opening external database access), and storage-account key listing (listkeys/action, harvesting long-lived access keys). Each is individually a real Azure admin action, so this rule flags on any single occurrence (level: high, not critical) -- true correlation (same caller identity, multiple of these operations, short window) needs a Sigma correlation document, which this corpus's rule format does not yet render; reviewers should cross-check CallerIpAddress/Caller across hits before escalating.
Verification discipline: the exact Defender-disabling PowerShell cmdlets and the exact renamed ScreenConnect service name are described narratively by the sources but no verbatim command/string was published by either -- deliberately left out of this rule's detection logic rather than guessed.
title: Storm-2949 -- Azure management-plane credential harvesting after SSPR-abuse account takeover (2026-05-18)
id: f6d00e7b-213f-51c7-b88d-40f044191e09
status: experimental
description: 'Real, actively-tracked cloud-identity campaign disclosed by Microsoft Threat Intelligence on 2026-05-18 (Storm-2949
-- temporary designation, not yet attributed to a named actor), cross-verified against independent secondary write-ups (SC
Media, TheCyberExpress, SOCPrime, Specops).
Confirmed by BOTH the primary source and at least one independent source: initial access via abuse of Microsoft Entra ID''s
Self-Service Password Reset (SSPR) flow -- the actor initiates an SSPR request against a targeted account and social-engineers
the victim (posing as internal IT support) into approving the resulting MFA prompt, letting the actor reset the password
and strip existing authentication methods, eliminating MFA as a control. The actor then uses the Microsoft Graph API plus
custom Python (Azure SDK) scripts to enumerate users, roles, service principals, and applications, searches OneDrive/SharePoint
for IT-ops files and VPN configs, and installs ScreenConnect (renamed to resemble a legitimate Windows component per the
independent write-ups, exact string not disclosed) for persistent remote access.
This rule targets the credential-harvesting stage, using the exact Azure Resource Manager operation names published directly
in Microsoft''s own advisory: publishing-profile retrieval (publishxml/action, which returns FTP/WebDeploy cleartext credentials),
SQL server firewall-rule creation (opening external database access), and storage-account key listing (listkeys/action,
harvesting long-lived access keys). Each is individually a real Azure admin action, so this rule flags on any single occurrence
(level: high, not critical) -- true correlation (same caller identity, multiple of these operations, short window) needs
a Sigma correlation document, which this corpus''s rule format does not yet render; reviewers should cross-check CallerIpAddress/Caller
across hits before escalating.
Verification discipline: the exact Defender-disabling PowerShell cmdlets and the exact renamed ScreenConnect service name
are described narratively by the sources but no verbatim command/string was published by either -- deliberately left out
of this rule''s detection logic rather than guessed.'
references:
- https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/
- https://www.scworld.com/brief/storm-2949-actor-targets-microsoft-365-and-azure-environments
- https://attack.mitre.org/techniques/T1552/
- https://attack.mitre.org/techniques/T1078/004/
author: WinstonRedGuard -- sigma plugin observed rules (derived from breach corpus)
date: '2026-08-05'
logsource:
product: azure
service: activitylogs
detection:
selection_publish_profile:
OperationName|contains: MICROSOFT.WEB/SITES/PUBLISHXML/ACTION
selection_sql_firewall_write:
OperationName|contains: MICROSOFT.SQL/SERVERS/FIREWALLRULES/WRITE
selection_storage_keys_listed:
OperationName|contains: MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION
condition: selection_publish_profile or selection_sql_firewall_write or selection_storage_keys_listed
falsepositives:
- Legitimate DevOps/CI pipeline identities performing routine publish-profile or key-rotation operations
- Infrastructure-as-code deployment tooling (Terraform/Bicep/ARM) running from a shared automation identity
level: high
tags:
- attack.t1552
- attack.t1078.004
- wrg.observed.campaign.storm_2949
- wrg.observed.vector.sspr_mfa_social_engineering
- wrg.observed.vector.azure_mgmt_plane_credential_harvest
- wrg.severity.high
- wrg.observed
- wrg.tactic.credential_access