BAE Systems Cyber Incident Shuts Down US Bankruptcy Noticing Center: Third-Party Risk and Detection Playbook for Defenders

---
title: Unauthorized Remote Monitoring and Management Tool Execution
id: 3b7a9c41-2e5d-4f8a-b912-6c4d8e1f5a07
status: experimental
description: Detects execution of remote access tools frequently abused in contractor intrusions and ransomware precursor activity. Tune the allowlist to your approved RMM stack.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://securityaffairs.com/201166/security/bae-systems-cyber-incident-takes-us-bankruptcy-noticing-center-offline-for-a-week.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\screenconnect.exe'
      - '\splashtop.exe'
      - '\aeroadmin.exe'
      - '\rustdesk.exe'
      - '\meshagent.exe'
      - '\ngrok.exe'
  filter_approved_rmm:
    Image|startswith:
      - 'C:\Program Files\ApprovedVendor\'
  condition: selection and not filter_approved_rmm
falsepositives:
  - Approved IT remote support tooling not yet in the allowlist
level: high
---
title: Mass Service Stop or Disable Activity
tid: 8f2c5d93-7a1b-4e6c-9d03-2b8f4a6e1c59
status: experimental
description: Detects bulk stopping or disabling of Windows services, a hallmark of ransomware pre-encryption staging and destructive incidents that cause prolonged outages.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - ' stop '
      - ' config '
      - ' delete '
  selection_disabled:
    CommandLine|contains:
      - 'start= disabled'
      - 'start=disabled'
  selection_ps:
    CommandLine|contains:
      - 'Stop-Service'
      - 'Set-Service'
      - 'Disable-Service'
  condition: 1 of selection_*
falsepositives:
  - Automated patching and maintenance windows — correlate with change tickets
  - Legitimate administrator service management on a single host
level: medium
---
title: Backup Catalog and Shadow Copy Deletion Attempt
tid: 1d4e7b26-9c3a-4f58-a672-5e9b2c8d3f41
status: experimental
description: Detects deletion of volume shadow copies and backup catalogs, a common precursor to outages requiring full environment rebuilds such as week-long service disruptions.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  selection_wbcdmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Backup software performing catalog maintenance (verify process ancestry)
level: critical

// Hunt: Anomalous logons and tool execution by service/vendor accounts
let Lookback = 14d;
let ServiceAccounts = dynamic(["svc-", "vendor", "contractor", "rmm", "support-"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where AccountName has_any (ServiceAccounts)
| where FileName in~ ("psexec.exe","wmic.exe","sc.exe","net.exe","net1.exe","vssadmin.exe","bcdedit.exe","wbadmin.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","msiexec.exe","anydesk.exe","teamviewer.exe","screenconnect.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(SigninLogs
| where TimeGenerated > ago(Lookback)
| where UserPrincipalName has_any (ServiceAccounts)
| summarize SignInCount=count(), DistinctIPs=dcount(IPAddress), IPs=make_set(IPAddress, 10), Countries=make_set(Location, 10) by UserPrincipalName, bin(TimeGenerated, 1h)
| where DistinctIPs > 3 or SignInCount > 50
);
// Secondary: single host authenticating to many targets in short window (lateral movement)
let Window = 10m;
let Threshold = 15;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (445, 3389, 5985, 5986, 22)
| summarize Targets=dcount(RemoteIP), TargetList=make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, Window)
| where Targets >= Threshold
| sort by Targets desc;

-- Hunt for unauthorized RMM binaries and shadow copy tampering artifacts
LET rmm_paths = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/AppData/**/AnyDesk.exe',
  'C:/Users/*/AppData/**/rustdesk.exe',
  'C:/Users/*/Downloads/**/ScreenConnect*.exe',
  'C:/ProgramData/**/AnyDesk.exe',
  'C:/Program Files*/TeamViewer/TeamViewer*.exe',
  'C:/Program Files*/Splashtop/**/SRManager.exe'
])
WHERE NOT FullPath =~ 'ApprovedVendor';

LET suspicious_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|recoveryenabled no|delete catalog|stop-service|net stop)'
   OR Name =~ '(?i)(anydesk|rustdesk|screenconnect|teamviewer)';

SELECT * FROM rmm_paths
UNION ALL
SELECT FullPath=NULL, Size=NULL, Mtime=NULL, Pid, Name, CommandLine, Exe, Username, CreateTime FROM suspicious_procs;

# Security Arsenal — Third-Party Intrusion Artifact Audit
# Run elevated. Review output before taking remediation action.

$Report = @()

# 1. Enumerate installed RMM tools (compare against your approved list)
$RMMNames = 'AnyDesk','TeamViewer','ScreenConnect','Splashtop','AeroAdmin','RustDesk','ConnectWise','LogMeIn','GoToMyPC'
$Installed = Get-ItemProperty HKLM:
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
  HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
  Where-Object { $n = $_.DisplayName; $RMMNames | Where-Object { $n -match $_ } } |
  Select-Object DisplayName, DisplayVersion, InstallDate
$Report += [pscustomobject]@{ Check='RMM Tools Found'; Result = ($Installed | Out-String) }

# 2. Verify Volume Shadow Copies are intact and not recently deleted
$Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$Report += [pscustomobject]@{ Check='Shadow Copies Present'; Result = ($null -ne $Shadows) }
$Report += [pscustomobject]@{ Check='VSS Service State'; Result = (Get-Service VSS).Status }

# 3. Detect services recently disabled (potential staging for disruption)
$Disabled = Get-CimInstance Win32_Service | Where-Object { $_.StartMode -eq 'Disabled' -and $_.State -eq 'Stopped' } |
  Select-Object Name, DisplayName, PathName
$Report += [pscustomobject]@{ Check='Disabled Services Count'; Result = $Disabled.Count }
$Disabled | Export-Csv -Path "$env:TEMP\disabled_services.csv" -NoTypeInformation

# 4. Local accounts created in the last 30 days (persistence check)
$NewAccounts = Get-LocalUser | Where-Object { $_.Enabled -and $_.PasswordLastSet -gt (Get-Date).AddDays(-30) }
$Report += [pscustomobject]@{ Check='Recently Enabled Local Accounts'; Result = ($NewAccounts.Name -join ', ') }

# 5. Check recovery configuration (bcdedit tamper indicator)
$Bcd = bcdedit | Out-String
$Report += [pscustomobject]@{ Check='Recovery Enabled'; Result = ($Bcd -match 'recoveryenabled\s+Yes') }

$Report | Format-List
# Remediation guidance:
# - Uninstall any RMM tool not on the approved list and block its binary via AppLocker/WDAC
# - Re-enable shadow copies: vssadmin list shadows / vssadmin create shadow
# - Investigate any disabled critical service against change management records
# - Disable and investigate unauthorized local accounts; force credential rotation