Scattered Spider — UNC3944 / Octo Tempest

Scattered Spider is a native-English-speaking, financially-motivated collective (overlapping with the broader "Com" ecosystem) that specializes in social-engineering the human perimeter. The signature play: call the IT help desk impersonating an employee (or, per the July 2025 FBI/CISA update, impersonate an employee to a third-party/outsourced IT provider), talk an agent into resetting a password and/or MFA, enroll an attacker-controlled authenticator, and log in as a legitimate user. From there they move fast — hours, not weeks — into SSO, VDI, cloud, and SaaS.

Because initial access rarely involves a dropped binary, endpoint AV signatures miss the front of the kill chain. The defensible signal is behavioral: abuse of legitimate remote-access tools (AnyDesk, TeamViewer, Splashtop, ScreenConnect, Tailscale, Ngrok, Teleport), LSASS credential theft with Sysinternals/Mimikatz, AD reconnaissance (ADExplorer, SharpHound), identity-provider anomalies (MFA resets, new device enrollment, added federated IdPs, backdoor IAM users), and — late in the chain — BYOVD EDR-killers (STONESTOP/POORTRY) and shadow-copy destruction preceding DragonForce ransomware and ESXi encryption.

Defender priority: Instrument the identity plane first. Alert on help-desk-driven MFA/credential resets and new authenticator enrollment, then chain endpoint hunts (RMM tooling → credential access → BYOVD → shadow-copy deletion) to catch the hands-on-keyboard phase before extortion. Treat any first-time appearance of a remote-access tool on a server or admin workstation as hunt-worthy.

Decisions

Working hypothesis: If Scattered Spider is operating in the environment, we will observe a help-desk-driven identity reset closely followed by (a) a legitimate remote-access tool appearing for the first time on an admin/server host, (b) LSASS/AD credential access, and (c) — before impact — BYOVD driver loads and shadow-copy deletion. Detecting any two of these in temporal proximity is high-confidence for an active intrusion.

Attack chain

Hypotheses (fidelity-ordered)

Scattered Spider infrastructure and file hashes are highly perishable and the tooling is largely legitimate software. Prefer the behavioral IOCs below; validate any atomic indicator against the current CISA AA23-320A appendix before deploying as a block.

The front of Scattered Spider's kill chain lives in identity and cloud audit logs. Run these in the source platform (or in Falcon NG-SIEM if the connector is ingesting them). They are the highest-value detections in this pack.

Queries Q3, Q4, and Q6 are strong promotion candidates for Custom IOAs (low FP, high confidence, terminal-stage). Q1/Q2 are best kept as scheduled hunts until baselined.

{
  "actor": "Scattered Spider",
  "aliases": ["UNC3944", "Octo Tempest", "0ktapus", "Muddled Libra", "LUCR-3", "Scatter Swine", "Storm-0875"],
  "mitre_group": "G1015",
  "generated": "2026-07-01",
  "confidence_note": "Infrastructure and hashes are highly perishable; prefer behavioral IOCs. Validate atomics against current CISA AA23-320A appendix.",
  "indicators": [
    { "type": "domain_pattern", "value": "*-sso.com | *-okta.com | *-helpdesk.com | *-vpn.com | *-servicedesk.com", "confidence": "medium", "action": "hunt", "source": "CISA AA23-320A", "expiry": "2026-10-01" },
    { "type": "tool", "value": "anydesk.exe, teamviewer.exe, screenconnect, splashtop, tailscale, rustdesk", "confidence": "medium", "action": "hunt", "source": "Trellix/Rapid7", "expiry": "2026-10-01" },
    { "type": "tool", "value": "ngrok.exe, tsh.exe, teleport, cloudflared", "confidence": "high", "action": "hunt", "source": "Darktrace/ReliaQuest", "expiry": "2026-10-01" },
    { "type": "tool", "value": "procdump, mimikatz, ADExplorer, SharpHound", "confidence": "high", "action": "hunt", "source": "Trellix", "expiry": "2026-10-01" },
    { "type": "malware", "value": "STONESTOP (loader) + POORTRY (signed driver) BYOVD toolkit", "confidence": "high", "action": "hunt", "source": "Trellix/industry", "expiry": "2026-10-01" },
    { "type": "network", "value": "*.ngrok.io, *.ngrok-free.app, *.teleport.sh, *.ts.net, *.trycloudflare.com", "confidence": "medium", "action": "hunt", "source": "web-hunter", "expiry": "2026-08-01" },
    { "type": "behavior", "value": "help-desk MFA reset + new authenticator enrollment <1h", "confidence": "high", "action": "detect", "source": "CrowdStrike/CISA", "expiry": "2027-01-01" },
    { "type": "behavior", "value": "new federated IdP/domain added to SSO tenant; auto account-linking", "confidence": "high", "action": "detect", "source": "Permiso LUCR-3", "expiry": "2027-01-01" },
    { "type": "behavior", "value": "AWS CloudTrail CreateUser + CreateAccessKey by compromised principal", "confidence": "high", "action": "detect", "source": "Permiso LUCR-3", "expiry": "2027-01-01" },
    { "type": "behavior", "value": "New-InboxRule with ForwardTo/RedirectTo/DeleteMessage to external", "confidence": "medium", "action": "detect", "source": "Microsoft/Red Canary", "expiry": "2027-01-01" },
    { "type": "ransomware", "value": "DragonForce payload; ESXi mass encryption", "confidence": "high", "action": "detect", "source": "CISA AA23-320A", "expiry": "2027-01-01" }
  ]
}

Playbook A — Enforce number-matching & phishing-resistant MFA (Entra ID)

1. Entra admin center > Protection > Authentication methods.
2. Enable "Microsoft Authenticator" > configure:
     - Require number matching for push notifications = Enabled (All users)
     - Show application name / geo in push = Enabled
3. Enable FIDO2 security key method; scope to Admins + IT/Helpdesk + Remote-access groups.
4. Conditional Access > New policy:
     - Users: Directory roles = all privileged roles + Helpdesk group
     - Grant: Require authentication strength = "Phishing-resistant MFA"
5. Report-only > validate > enable. Disable SMS/voice as an approved method.

Playbook B — Block vulnerable drivers (BYOVD) — HVCI + blocklist

# Enable Microsoft vulnerable-driver blocklist (Windows built-in)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Enable Memory Integrity (HVCI)
# HVCI needs VBS enabled as well -- the scenario key alone is inert and the
# control silently never activates. All three values are required.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
# Prereqs: UEFI + Secure Boot + virtualization extensions. Reboot required.
# PILOT FIRST -- incompatible legacy drivers can block boot under HVCI.
# Verify AFTER reboot (SecurityServicesRunning must contain 2):
#   (Get-CimInstance Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
# Rollback: set both DeviceGuard values and the scenario Enabled back to 0, then reboot.
#   If the host will not boot, revert from Safe Mode or WinRE.

# Verify (reboot required)
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object -ExpandProperty SecurityServicesRunning
# 2 in the list = HVCI running. Confirm EDR "Tamper Protection" is ON in your console.

Playbook C — Enable LSA Protection (PPL) + Credential Guard

# LSASS as Protected Process Light
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

# Credential Guard via Device Guard (also needs HVCI above)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags /t REG_DWORD /d 1 /f

# Verify after reboot
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object SecurityServicesConfigured, SecurityServicesRunning
# Test that comsvcs MiniDump against lsass now fails (should be blocked / access denied).

Playbook D — CQL spot-check after hardening

// Confirm no successful LSASS dump activity post-PPL rollout
#event_simpleName=ProcessRollup2
| CommandLine=/comsvcs\.dll.{0,40}MiniDump|procdump.{0,60}lsass/i
| table([@timestamp, ComputerName, UserName, CommandLine])
// Expect: zero hits, or only sanctioned DFIR hosts.

• Network-contain affected hosts via Falcon; do not tip off the actor on monitored channels — assume they are watching Teams/Slack/Exchange and IR calls. Move IR comms out-of-band immediately.
• Suspend the compromised identities; revoke all active sessions/refresh tokens (Entra "Revoke sessions", Okta clear sessions).
• Freeze help-desk password/MFA resets org-wide pending identity re-verification.

• Remove attacker MFA enrollments; delete rogue federated IdPs/domains and backdoor IAM users; rotate the keys they created.
• Remove malicious inbox/forwarding rules; hunt for additional persistence (RMM installs, scheduled tasks, new local admins).
• Rotate credentials broadly — privileged accounts, service accounts, and any secrets exposed via LSASS/AD dumps; force password reset with re-verification.
• Uninstall unsanctioned RMM; remove BYOVD drivers; confirm EDR tamper protection restored on all hosts.

• Restore from immutable/off-domain backups only after eradication is confirmed; validate ESXi integrity before repowering VMs.
• Re-enable services under monitoring; keep §7 identity hunts and Q1–Q9 in heightened alerting for 30+ days.
• Post-incident: enforce phishing-resistant MFA, harden help-desk verification, and brief execs on SIM-swap risk.

TITLE:       Threat Hunt — Scattered Spider (UNC3944 / Octo Tempest)
SCOPE:       Identity plane (Okta/Entra), Windows endpoints & servers, cloud IAM, M365, ESXi
HYPOTHESIS:  A help-desk-driven identity reset is followed by RMM tooling, credential
             access, and pre-encryption behaviors indicating an active intrusion.
QUERIES RUN: Q1 RMM exec · Q2 tunnels · Q3 BYOVD · Q4 LSASS · Q5 AD recon ·
             Q6 shadow-copy delete · Q7 service tamper · Q8 push-bombing · Q9 tunnel DNS
             + §7 native identity/cloud audit hunts
DATA:        ProcessRollup2, NewExecutableWritten/PeFileWritten, DnsRequest,
             UserLogonFailed2; (IdP/CloudTrail/O365 if ingested)
FINDINGS:    <populate>
GAPS:        IdP/cloud/O365/ESXi log ingestion; per-env RMM baseline
ACTIONS:     Promote Q3/Q4/Q6 to Custom IOA; enforce number-matching MFA;
             harden help-desk verification; enable HVCI + LSA PPL
OWNER:       HuntPack
STATUS:      Draft v0.1 · 2026-07-01

Automated pack — treat queries as starting points. Validate field names and tune FP exclusions in your own tenant before relying on any detection. Atomic IOCs (domains/hashes) for this actor are perishable; re-check the current CISA AA23-320A appendix.