Use AI to reconcile sign-ins, credentials, consent, roles and activity after application-identity compromise without overstating impact.
Why application identity compromise needs a different investigation
Microsoft reported on October 21 that Storm-0940 used ARTEX agentic AI during activity tied to a ConnectWise supply-chain compromise. Microsoft observed password spraying from October 10 through 14 and later attempted sign-ins to more than 2,250 tenants with stolen application credentials. The company also described follow-on Microsoft Graph and directory activity in some organizations. These are Microsoft-observed figures, not a measure of exposure at every tenant.
The important investigative distinction is between an affected application, a successful service-principal authentication and proven access to mail, files, directory objects or secrets. Microsoft explicitly warned that the first two do not establish data access, while absent Graph logs do not prove that access did not occur. CyberScoop independently covered the attribution and supply-chain implications on October 21.
A focused Firecrawl search on October 26 returned Microsoft's primary analysis first and several fresh independent reports among the leading results. That is evidence of current public attention, not Google ranking, traffic or proof that a particular organization was affected.
1. Preserve and name every identity before changing it
Start with the vendor advisory and your approved incident process. Keep affected application connections disabled when authoritative guidance requires it, but do not begin by deleting enterprise applications. Preserve sign-in, audit, consent, role-assignment, Microsoft Graph, Exchange, SharePoint, Key Vault and endpoint records first; deletion can remove the identifiers needed to connect events.
Create one row per application ID and the corresponding local service-principal object ID. Add display name, tenant, credential identifiers and creation dates, owners, delegated and application permissions, directory roles, publisher evidence, first and last observed activity, and evidence locations. Include the investigation window your responders approved, rather than assuming the public campaign dates fit your environment.
The tools are ordinary incident-response controls: authoritative tenant exports, a case system, a protected analysis workspace and an approved assistant that does not retain sensitive input. Redact tokens, secrets, customer content and unnecessary personal data before any model sees the records.
- Keep stable object IDs; names alone can change.
- Hash or otherwise preserve exported evidence according to your response process.
- Record unavailable log sources as unavailable, not clean.
2. Build an evidence grid that prevents accidental overclaiming
Separate evidence into four lanes: authentication, credential and ownership changes, authorization changes, and resource activity. A successful sign-in belongs in the first lane. Added secrets, certificates or owners belong in the second. Consent and role assignments belong in the third. Mail, file, directory, Graph or Key Vault operations belong in the fourth.
Normalize time zones and retain the original record ID, source and timestamp. Ask the assistant to join only on explicit identifiers and bounded time windows. Do not let fuzzy name matching silently merge similarly named applications or users.
The expected output is a gap-aware table: claim, supporting record IDs, contradicting records, missing evidence, confidence label and required reviewer. It should make it impossible to turn ‘authentication succeeded’ into ‘data was exfiltrated’ without a resource-level record.
3. Use a prompt that cites records and preserves unknowns
Example prompt: ‘Using only these sanitized exports, create an application-identity timeline. For every statement cite the exact source and record ID. Separate failed sign-ins, successful authentication, credential changes, consent or role changes, and resource operations. Do not infer data access from authentication. Mark unsupported impact as unknown and list the log source needed to resolve it.’
Run the prompt on a fixed case export, then compare row counts and a sample of joins against the originals. Require a second analyst to review every high-impact claim and every proposed containment action. If the assistant produces a claim without a record ID, remove it from the decision packet.
This workflow is illustrative; DeepSecurity.io did not test a tenant or reproduce the campaign. AI can reduce clerical correlation work, but authoritative logs and responder validation determine the finding.
4. Contain and rotate in an evidence-preserving order
Follow the affected vendor's current instructions and your incident commander. Sequence changes so the team can still identify what happened: capture the before-state, disable or restrict the affected connection, remove unauthorized owners or consent through approved change control, rotate exposed credentials, and verify that dependent workloads use the replacement.
Review successful and failed sign-ins separately. Microsoft described high-volume password spraying before the application-credential activity, so account authentication and application identity evidence may overlap without being the same compromise path. Preserve both timelines and connect them only when identifiers or other authoritative evidence support the relationship.
After containment, repeat the activity review for the residual window. Check whether new credentials, owners, consent grants, roles, inbox rules, file shares or secret accesses appeared after the first action. Document every failed remediation and service interruption instead of editing the timeline to look linear.
5. Close with an impact statement that can survive review
Write three separate conclusions: identity compromise status, observed resource access and data-impact assessment. Each conclusion should be proven, disproven or unknown. Include the exact log coverage period, retention limits and systems that could not be queried.
A defensible handoff contains the identity inventory, cited timeline, change tickets, credential-rotation evidence, residual hunt, exceptions and named reviewer. Keep the case open when the missing evidence could materially change impact; do not use an assistant-generated narrative as a substitute for the source packet.
The reusable outcome is an application-identity response template that works across SaaS integrations, service principals and automation accounts. It makes the next supply-chain investigation faster without granting AI authority over production controls.
A compact operations handoff
Give operations a one-page status with affected and cleared identities, remaining unknowns, owners, deadlines and links to immutable evidence. State explicitly which conclusions came from source records and that AI only organized sanitized exports.
- Do not delete enterprise applications before evidence preservation.
- Do not equate successful authentication with resource access.
- Do not equate missing logs with no activity.
Put the insight into practice.
Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.
Talk with Deep Security