BAE Systems Breach Disrupts Federal Bankruptcy Court Noticing — Third-Party Compromise Response Guide

---
title: Unauthorized Remote Access Tool Execution in Contractor Environment
id: 8c4f2a91-3d7b-4e6a-9f21-5b8d0c3e7a44
status: experimental
description: Detects execution of commonly abused remote access tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) from unexpected paths or by non-admin users. RMM abuse is the dominant persistence/lateral movement mechanism in third-party contractor intrusions such as the BAE Systems incident that disrupted federal bankruptcy court noticing.
references:
  - https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/18
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.client.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\atera_agent.exe'
      - '\splashtop_streamer.exe'
  filter_known_paths:
    Image|startswith:
      - 'C:\Program Files\AnyDesk'
      - 'C:\Program Files\TeamViewer'
      - 'C:\Program Files (x86)\TeamViewer'
      - 'C:\Program Files (x86)\ScreenConnect Client'
  condition: selection_tool and not filter_known_paths
falsepositives:
  - IT support staff running portable RMM binaries during sanctioned remote sessions; maintain an allowlist of approved RMM paths and update the filter
level: high
---
title: Volume Shadow Copy Deletion Prior to Service Disruption
id: 2e7b9c14-6a1f-4d83-b5e2-8f0a4c9d6e31
status: experimental
description: Detects deletion of volume shadow copies or backup catalog manipulation via vssadmin, wmic, bcdedit, or wbadmin. This is a high-fidelity precursor to destructive/encryption impact that typically precedes the kind of forced service outage seen in the federal bankruptcy court noticing disruption.
references:
  - https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/18
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains: 'recoveryenabled no'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Rare; legitimate backup administrators occasionally clear shadow copies during storage reclamation — correlate with change tickets
level: critical
---
title: Interactive Logon by Application Service Account
id: 5a1d8e36-9c4b-4f27-a3d8-2e6b1f7c9052
status: experimental
description: Detects interactive (Type 2) or RemoteInteractive (Type 10) logons by accounts matching common service account naming patterns. Service accounts backing hosted applications (such as the court noticing system) should never log on interactively; this behavior is a strong indicator of credential theft and hands-on-keyboard intrusion in a service provider environment.
references:
  - https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/18
tags:
  - attack.persistence
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: windows
detection:
  selection:
    LogonType:
      - 2
      - 10
    TargetUserName|contains:
      - 'svc-'
      - 'svc_'
      - '-svc'
      - 'service'
  condition: selection
falsepositives:
  - Poorly governed environments where admins interactively log on with service accounts; tune TargetUserName patterns to your actual naming convention
level: high

// Hunt 1: Unauthorized remote access tooling across endpoints (Defender)
// Baseline your approved RMM list first; anything outside it in a contractor
// or hosted-service environment warrants immediate investigation.
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("anydesk.exe", "screenconnect.client.exe", "teamviewer.exe",
    "teamviewer_service.exe", "atera_agent.exe", "splashtop_streamer.exe", "rustdesk.exe", "ultraviewer.exe")
| extend RemoteIP = tostring(parse_json(InitiatingProcessCommandLine))
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    LaunchCount = count(), DistinctUsers = dcount(AccountName),
    Users = make_set(AccountName), CommandLines = make_set(ProcessCommandLine)
    by DeviceName, FileName, FolderPath
| order by FirstSeen asc

// Hunt 2: Shadow copy deletion / backup tampering preceding service disruption (Sentinel, SecurityEvent 4688)
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4688
| where NewProcessName has_any ("vssadmin.exe", "wmic.exe", "wbadmin.exe", "bcdedit.exe")
| where CommandLine has_any ("delete shadows", "shadowcopy delete", "delete catalog",
    "recoveryenabled no", "delete systemstatebackup")
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName
| order by TimeGenerated desc

// Hunt 3: Interactive logons by service accounts into the hosted application tier (Sentinel)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| where LogonType in (2, 10)
| where TargetUserName matches regex @"(?i)(svc[-_]|[-_]svc|service)"
| summarize LogonCount = count(), SourceIPs = make_set(IpAddress), Hosts = make_set(Computer)
    by TargetUserName, LogonType
| order by LogonCount desc

-- Hunt for unauthorized RMM binaries and recent suspicious executables
-- Deploy across the estate as a hunt; scope to servers hosting customer-facing services first
LET rmm_paths = SELECT FullPath, Size, Mtime
FROM glob(globs=[
    'C:/Users/*/Downloads/*anydesk*',
    'C:/Users/*/Downloads/*teamviewer*',
    'C:/Users/*/Downloads/*screenconnect*',
    'C:/Users/*/Downloads/*rustdesk*',
    'C:/Users/*/AppData/**/anydesk.exe',
    'C:/ProgramData/**/screenconnect*',
    'C:/ProgramData/**/atera*',
    'C:/Temp/*.exe'
])

LET suspect_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(anydesk|teamviewer|screenconnect|rustdesk|ultraviewer|atera|splashtop)'
   OR CommandLine =~ '(?i)(vssadmin.*delete|shadowcopy.*delete|bcdedit.*recoveryenabled)'

SELECT * FROM rmm_paths
UNION ALL
SELECT Exe AS FullPath, NULL AS Size, CreateTime AS Mtime FROM suspect_procs

# Security Arsenal — Third-Party Intrusion Triage Script
# Run with elevated privileges on servers hosting critical services
# Outputs a consolidated CSV of findings per host

$Findings = @()

# 1. Scan for unauthorized RMM binaries outside approved paths
$ApprovedPaths = @("C:\Program Files\AnyDesk", "C:\Program Files\TeamViewer", "C:\Program Files (x86)\TeamViewer")
$RmmNames = @("anydesk.exe","teamviewer.exe","teamviewer_service.exe","screenconnect.client.exe","atera_agent.exe","splashtop_streamer.exe","rustdesk.exe")

foreach ($Name in $RmmNames) {
    $Hits = Get-CimInstance Win32_Process -Filter "Name='$Name'" -ErrorAction SilentlyContinue
    foreach ($Hit in $Hits) {
        $ExePath = $Hit.ExecutablePath
        $Approved = $false
        foreach ($Path in $ApprovedPaths) { if ($ExePath -like "$Path*") { $Approved = $true } }
        if (-not $Approved) {
            $Findings += [PSCustomObject]@{
                Category = "UnauthorizedRMM"
                Detail   = "$Name running from $ExePath (PID $($Hit.ProcessId))"
                Severity = "High"
                Host     = $env:COMPUTERNAME
            }
        }
    }
}

# 2. Check shadow copy status — missing shadows on a server is an impact red flag
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $Shadows) {
    $Findings += [PSCustomObject]@{
        Category = "ShadowCopyAbsent"
        Detail   = "No volume shadow copies present — investigate vssadmin/wmic deletion"
        Severity = "Critical"
        Host     = $env:COMPUTERNAME
    }
}

# 3. Hunt security log for vssadmin/wmic/bcdedit tampering (last 14 days)
$TamperEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'vssadmin.*delete shadows|shadowcopy delete|bcdedit.*recoveryenabled|wbadmin.*delete catalog' }
foreach ($Evt in $TamperEvents) {
    $Findings += [PSCustomObject]@{
        Category = "BackupTampering"
        Detail   = ($Evt.Message -split "`n" | Select-String 'Command Line').ToString()
        Severity = "Critical"
        Host     = $env:COMPUTERNAME
    }
}

# 4. Interactive logons by service accounts (last 7 days)
$SvcLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(2|10)' -and $_.Message -match '(?i)svc[-_]|[-_]svc' }
foreach ($Evt in $SvcLogons) {
    $Findings += [PSCustomObject]@{
        Category = "SvcAcctInteractiveLogon"
        Detail   = "Service account interactive/RDP logon at $($Evt.TimeCreated)"
        Severity = "High"
        Host     = $env:COMPUTERNAME
    }
}

$Findings | Export-Csv -Path "C:\Temp\intrusion_triage_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "[+] Triage complete. $($Findings.Count) findings exported to C:\Temp\intrusion_triage_$env:COMPUTERNAME.csv"