Helpdesk impersonation has become the entry point of choice for identity-based intrusions, but most detection programs are still calibrated to catch it at the front door. Once an attacker walks through that door with a freshly reset password or a newly provisioned MFA token, the conventional detection model offers little. CISA advisory AA23-347A documents exactly this pattern, covering the Scattered Spider campaign (also tracked as UNC3944 by Mandiant, the Google Cloud threat-intelligence firm). The impersonation call itself went undetected, but four subsequent stages of the attack chain generated forensic signals that were each individually detectable without knowledge of the original social-engineering moment.
How Privilege Enumeration and Lateral Movement Expose the Intruder
After a successful MFA reset or password change through a compromised helpdesk, the first move is not exfiltration. Per MITRE ATT&CK, the adversary tradecraft taxonomy, technique T1087 (Account Discovery), the attacker enumerates what the freshly obtained identity can reach. In enterprise environments this means querying Azure Active Directory (now Microsoft Entra ID) for group memberships, role assignments, and service principal permissions. The detection signal is behavioral: account-discovery commands from a user context that has never run them before, or running at 2 AM in a directory that sees human logins only during business hours.
Lateral movement follows once the attacker has mapped the privilege graph. The Scattered Spider actors used legitimate remote monitoring and management (RMM) tools such as AnyDesk and TeamViewer to move between endpoints without triggering signature-based controls. The signal that does not depend on catching the original helpdesk impersonation is first-time RMM binary execution from a user account with no prior RMM usage history. According to MITRE ATT&CK T1219 (Remote Access Software), this tooling is exactly what attackers favor because endpoints already trust it. A user account executing a remote-access binary for the first time within 72 hours of an MFA change is a compound indicator worth Tier 1 triage. Our earlier coverage of lateral movement detection techniques describes how per-user baselines make this actionable.
Persistence Mechanisms and Exfiltration Signals Each Stand Alone
Persistence is where many post-impersonation intrusions become durable over weeks or months. Scattered Spider registered new MFA devices against compromised accounts after initial access, effectively cloning their foothold so that a future password reset would not evict them. The detection signal is new MFA device enrollment from a geography, IP range, or device type that has never enrolled for this account before. Identity provider audit logs from Microsoft Entra ID, Okta (the identity and access management platform), or Ping Identity produce this event natively. The gap is not tool coverage: the alert is rarely tuned to fire on first-time enrollment from a novel device class rather than on any enrollment.
A second persistence mechanism was SIM-swapping the victim phone number so voice-based MFA would route to attacker-controlled hardware. Per the CISA advisory, carriers processed these swaps without verifying that the account holder had initiated the request. The detection signal is a mobile number change in the identity provider MFA profile that did not originate from a self-service portal session authenticated by the existing device. Most organizations log MFA profile changes; few alert on the subset that came from a helpdesk ticket rather than the end user session.
Exfiltration in these campaigns ran through legitimate cloud sync services, primarily SharePoint (Microsoft enterprise document platform) and OneDrive, to bypass data-loss prevention (DLP) controls tuned to block known exfiltration tools. The detection signal is a volume anomaly: a user uploading data to cloud sync at a rate statistically outside their own historical baseline, not a site-wide threshold. Per NIST SP 800-92 log management guidance, per-user behavioral baselines for cloud-sync egress are the recommended calibration frame. A 500 MB site-wide daily threshold misses the attacker uploading 1 GB from an account whose historical baseline is under 5 MB per week. As we noted in our coverage of the Marks and Spencer helpdesk verification case, exfiltration windows in these incidents often run weeks because per-user baselines were not in place.
Four Controls Independent of the Original Helpdesk Impersonation
Each stage of this chain offers a detection surface that fires whether or not anyone caught the social-engineering call. A security operations team that tunes these four signals does not need to have identified the initial helpdesk impersonation to contain Scattered Spider-style intrusions before exfiltration completes.
Alert on MFA device enrollment following any helpdesk-initiated credential change – Any new authenticator registration within 72 hours of a helpdesk-driven password reset or MFA reset should generate a Tier 1 triage event. CISA advisory AA23-347A identifies this compound event as the highest-fidelity post-impersonation signal available to identity teams.
Build per-user RMM baseline profiles and alert on first-time execution – Remote-access binary execution from a user account with no prior RMM history is a high-signal lateral-movement indicator that signature-based controls miss. The MITRE ATT&CK T1219 documentation describes the technique; what is missing in most environments is the per-user baseline that makes first-time execution detectable as a boolean rather than a volume threshold.
Tune DLP and cloud access security broker (CASB) controls to per-user egress baselines – Cloud sync exfiltration targeting accounts with historically low upload activity will not trip a site-wide daily volume alert. Per NIST SP 800-92, effective log-based detection requires establishing user-specific behavioral baselines before anomaly thresholds are applied.
Require out-of-band verification for privileged-account MFA resets – CISA advisory AA23-347A recommends a second verification channel for MFA resets on accounts holding administrative privileges, one that differs from the impersonation channel. An attacker who placed the helpdesk call cannot intercept a confirmation routed to the account holder’s manager via a separate authentication path. The four forensic signals above all exist because Scattered Spider passed through four unmonitored checkpoints after the original helpdesk impersonation call; out-of-band verification closes the gate before any of them need to fire.
Join our LinkedIn group Information Security Community!
