Scattered Spider

index=okta sourcetype=OktaIM2:log
eventType="user.mfa.okta_verify.deny_push"
| bucket _time span=5m
| stats count by user, _time
| where count > 5

index=okta sourcetype=OktaIM2:log
eventType="user.mfa.factor.activate"
| stats count by user, displayMessage, client.ipAddress
| lookup known_mfa_devices.csv user OUTPUT expected_device
| where isnull(expected_device)

index=windows sourcetype=WinEventLog
(ProcessName="*TeamViewer*" OR ProcessName="*AnyDesk*" OR ProcessName="*ScreenConnect*" OR ProcessName="*ngrok*")
| stats count by ComputerName, ProcessName, User
| where NOT match(ComputerName, "IT-*")

SigninLogs
| where ResultType == 500121  // MFA denied
| summarize DeniedCount=count() by UserPrincipalName, bin(TimeGenerated, 5m)
| where DeniedCount > 5
| project TimeGenerated, UserPrincipalName, DeniedCount

OfficeActivity
| where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| where Parameters has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo")
| project TimeGenerated, UserId, Operation, Parameters

DeviceNetworkEvents
| where RemoteUrl has_any ("ngrok.io", "ngrok.com", "tunnel.us.ngrok.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

title: Scattered Spider RMM Tool Deployment
id: INT-SPIDER-001
status: experimental
description: Detects RMM tools commonly used by Scattered Spider
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\TeamViewer.exe'
            - '\AnyDesk.exe'
            - '\ScreenConnect.ClientService.exe'
            - '\ngrok.exe'
            - '\Splashtop*.exe'
    condition: selection
level: high

title: NTDS.dit Access via Volume Shadow Copy
id: INT-SPIDER-002
status: experimental
description: Detects credential dumping via shadow copies
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'ntds.dit'
            - 'shadow'
    condition: selection
level: critical