Scottish Government COPFS Breach via Third-Party Supplier: Detection and Supply-Chain Defense Guide

---
title: Third-Party or Vendor Account Anomalous Data Access
description: Detects service accounts or named vendor accounts performing bulk file access, archive creation, or access from unusual sources — consistent with supplier credential abuse leading to data theft.
logsource:
  product: windows
  category: process_creation
detection:
  selection_archive_tools:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winzip.exe'
      - '\tar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.zip'
      - '.7z'
      - '.rar'
  selection_user_context:
    User|contains:
      - 'svc_'
      - 'svc-'
      - 'vendor'
      - 'msp'
      - 'support'
  condition: selection_archive_tools and selection_user_context
falsepositives:
  - Scheduled vendor backup jobs — baseline and whitelist known maintenance windows and job names
level: high
status: experimental
author: Security Arsenal
date: 2026/01/15
references:
  - https://attack.mitre.org/techniques/T1560/
  - https://attack.mitre.org/techniques/T1078/
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1078
id: 3f9c2a71-8b4d-4e6a-9c1f-2d5e7a8b9c01
---
title: Mass File Access from Non-Standard Process
description: Detects non-productivity processes reading large volumes of files from document shares or case-management directories — a hallmark of vendor-tooling abuse for bulk collection.
logsource:
  product: windows
  category: file_event
detection:
  selection_paths:
    TargetFilename|contains:
      - '\casefiles\'
      - '\casework\'
      - '\legal\'
      - '\evidence\'
      - '\shared\documents\'
  selection_suspicious_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rclone.exe'
      - '\curl.exe'
      - '\wscript.exe'
  condition: selection_paths and selection_suspicious_image
falsepositives:
  - Legitimate document migration tooling — verify against change records
level: medium
status: experimental
author: Security Arsenal
date: 2026/01/15
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://attack.mitre.org/techniques/T1567/
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1567
id: 7b1e4d92-3c5f-4a8b-b2d6-9e0f1a3c5d72
---
title: OAuth Application Granted Broad Mail or File Permissions
description: Detects consent grants giving an application Mail.Read, Files.Read.All, or full_access scopes — a common vendor-integration abuse vector in supply-chain intrusions.
logsource:
  product: azure
  service: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add app role assignment to service principal'
  selection_scope:
    TargetResources|contains:
      - 'Mail.Read'
      - 'Files.Read.All'
      - 'full_access_as_app'
      - 'Sites.Read.All'
      - 'Directory.Read.All'
  condition: selection_operation and selection_scope
falsepositives:
  - Approved enterprise application onboarding — maintain a vetted app allowlist and alert on anything outside it
level: high
status: experimental
author: Security Arsenal
date: 2026/01/15
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1550/
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1528
id: c4a8f1e6-2d7b-49c3-a5e1-8f3b6d0a2e94

// Hunt: anomalous third-party / service account activity consistent with supplier compromise
// Looks for vendor-pattern accounts with unusual logon sources, off-hours activity,
// and bulk data access — run across a 14-day window and compare against your baseline.
let lookback = 14d;
let vendor_accounts = dynamic(["svc_", "svc-", "vendor", "msp", "support", "helpdesk"]);
let baseline = SecurityEvent
    | where TimeGenerated between (ago(90d) .. ago(lookback))
    | where EventID == 4624
    | where Account has_any (vendor_accounts)
    | summarize KnownIPs = make_set(IpAddress) by Account;
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4624
| where Account has_any (vendor_accounts)
| where LogonType in (3, 10)  // network and remote interactive — typical vendor access paths
| join kind=leftanti (baseline) on Account, $left.IpAddress == $right.KnownIPs
| extend HourOfDay = datetime_part("hour", TimeGenerated)
| extend OffHours = HourOfDay < 6 or HourOfDay > 22
| summarize FirstSeen = min(TimeGenerated),
            LogonCount = count(),
            DistinctSources = dcount(IpAddress),
            SourceIPs = make_set(IpAddress),
            TargetSystems = make_set(Computer),
            AnyOffHours = max(OffHours)
    by Account, bin(TimeGenerated, 1d)
| where DistinctSources > 1 or AnyOffHours == 1 or LogonCount > 50
| sort by LogonCount desc;

// Companion hunt: bulk file reads against sensitive shares followed by egress,
// surfaced via Defender for Endpoint telemetry
let sensitive_paths = dynamic(["casefile", "casework", "evidence", "legal", "witness"]);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (sensitive_paths)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize FileOps = count(), DistinctFiles = dcount(FileName), Processes = make_set(InitiatingProcessFileName)
    by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
| where FileOps > 200
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIPType == "Public"
    | summarize EgressConnections = count(), RemoteDestinations = make_set(RemoteUrl)
        by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
) on DeviceName, InitiatingProcessAccountName, TimeGenerated
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileOps, DistinctFiles, Processes, EgressConnections, RemoteDestinations;

-- Hunt for archive staging and compression artifacts left by bulk collection
-- Run across endpoints and servers that host shared or case-management data
SELECT FullPath,
       Size,
       Mtime,
       Ctime,
       hash(path=FullPath) AS FileHash
FROM glob(globs=[
    'C:\\Users\\**\\*.7z',
    'C:\\Users\\**\\*.rar',
    'C:\\ProgramData\\**\\*.zip',
    'C:\\Windows\\Temp\\**\\*.zip',
    'C:\\Windows\\Temp\\**\\*.7z'
])
WHERE Mtime > (now() - 1209600)  -- last 14 days
  AND Size > 10000000            -- >10MB archives are the interesting ones
ORDER BY Mtime DESC

# Third-party access audit and containment — run on domain controllers / management hosts
# 1) Inventory service and vendor-pattern accounts and their last logons
Get-ADUser -Filter {Name -like "svc_*" -or Name -like "*vendor*" -or Name -like "*msp*" -or Name -like "*support*"} `
  -Properties LastLogonDate, PasswordLastSet, MemberOf, Enabled |
  Select-Object Name, SamAccountName, Enabled, LastLogonDate, PasswordLastSet,
    @{N='Groups';E={($_.MemberOf | Get-ADGroup | Select-Object -ExpandProperty Name) -join '; '}} |
  Export-Csv -Path ".\third_party_account_inventory.csv" -NoTypeInformation

# 2) Flag vendor accounts with excessive privilege for immediate review
$PrivilegedGroups = @("Domain Admins","Enterprise Admins","Administrators","Backup Operators")
foreach ($g in $PrivilegedGroups) {
  Get-ADGroupMember -Identity $g -Recursive -ErrorAction SilentlyContinue |
    Where-Object {$_.SamAccountName -match 'svc_|vendor|msp|support'} |
    ForEach-Object { Write-Warning "$($_.SamAccountName) is a member of $g — review immediately" }
}

# 3) Review Azure AD / Entra app consents for over-scoped vendor integrations
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All" -NoWelcome
Get-MgServicePrincipal -All | ForEach-Object {
  $sp = $_
  Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue |
    Where-Object {$_.Scope -match 'Mail.Read|Files.Read.All|Sites.Read.All|full_access'} |
    Select-Object @{N='AppName';E={$sp.DisplayName}}, @{N='AppId';E={$sp.AppId}}, Scope, ConsentType
} | Export-Csv -Path ".\broad_oauth_consents.csv" -NoTypeInformation

# 4) Emergency lever: disable a confirmed-compromised vendor account (uncomment when authorized)
# Disable-ADAccount -Identity "svc_vendoraccount"
# Revoke-MgSignInSession -UserId "vendoraccount@yourdomain.tld"