The Oncology Institute Breach: Third-Party Supply Chain Compromise — Detection and Hardening Guide

---
title: Potential Vendor Account Interactive Logon
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects interactive logons (Type 2 or 10) from accounts matching vendor naming conventions or external group memberships, which may indicate misuse of third-party credentials.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2025/11/01
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType:
      - 2 # Interactive
      - 10 # RemoteInteractive
    LogonType|contains:
      - 'Vendor'
      - 'Support'
      - 'Admin'
  filter_legit:
    UserName|contains:
      - 'LocalAdmin'
      - 'Administrator'
falsepositives:
  - Legitimate vendor maintenance activities
level: high
---
title: Suspicious PowerShell Data Staging
id: 9b2c3d4e-5f6a-7890-1234-567890abcdef
status: experimental
description: Detects PowerShell commands often used to stage data for exfiltration, such as compression (Compress-Archive) or large file recursion, commonly seen in PHI theft.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2025/11/01
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Compress-Archive'
      - 'Copy-Item -Recurse'
      - 'Invoke-WebRequest'
  condition: selection
falsepositives:
  - Administrative backup scripts
level: medium
---
title: High Volume Egress to Non-Standard Ports
id: 0c3d4e5f-6a7b-8901-2345-678901abcdef
status: experimental
description: Detects network connections with high byte counts sent to non-standard ports or external IPs, indicative of data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2025/11/01
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: true
    DestinationPort|not:
      - 443
      - 80
      - 53
  filter_noise:
    DestinationIsIpv6: 'false'
  condition: selection | not filter_noise
falsepositives:
  - Legitimate cloud backup traffic
level: high

// Hunt for third-party vendor logons outside of business hours
// Adjust the 'VendorName' and 'BusinessHours' variables to fit your environment
let VendorAccounts = Dynamic(["*Vendor*", "*Support*", "*Contractor*"]);
let BusinessHours = bin(now(), 1h);
SecurityEvent
| where EventID == 4624
| where LogonType in (2, 10) // Interactive or RemoteInteractive
| where TimeGenerated > ago(7d)
| parse tostring(TargetUserName) with Account "\\" User 
| where User has_any (VendorAccounts)
| project TimeGenerated, Computer, Account, User, IpAddress, WorkstationName
| summarize count() by User, IpAddress, bin(TimeGenerated, 1h)
| where count_ > 5 // Threshold for multiple logons
| order by TimeGenerated desc

-- Hunt for established network connections to external IPs
-- and processes associated with common admin tools
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Laddr.IP AS LocalIP, 
  Raddr.IP AS RemoteIP, 
  Raddr.Port AS RemotePort, 
  State
FROM netstat()
WHERE State = 'ESTABLISHED'
  AND NOT Raddr.IP IN ('127.0.0.1', '::1', '0.0.0.0')
  AND (
    -- Look for common webshells or admin tools
    Name =~ 'powershell.exe' 
    OR Name =~ 'cmd.exe'
    OR Name =~ 'w3wp.exe'
  )
  -- Flag non-standard ports
  AND Raddr.Port NOT IN (80, 443, 22)

<#
.SYNOPSIS
    Audit and Disable Inactive Third-Party Vendor Accounts.
.DESCRIPTION
    This script scans Active Directory for accounts matching a 'Vendor' description
    or naming convention and disables them if they have not logged in within 90 days.
    This is a crucial step to contain supply chain risks.
#>

Import-Module ActiveDirectory

$InactiveDays = 90
$VendorKeywords = @("Vendor", "Contractor", "Support", "ThirdParty")
$TimeThreshold = (Get-Date).AddDays(-$InactiveDays)
$ReportPath = ".\Vendor_Account_Audit_$(Get-Date -Format yyyyMMdd).csv"

Write-Host "[*] Starting Vendor Account Audit..."

$VendorUsers = Get-ADUser -Filter * -Properties Description, LastLogonDate, Enabled | 
                Where-Object { 
                    $_.Enabled -eq $true -and 
                    ($_.Description -match ($VendorKeywords -join '|') -or $_.SamAccountName -match ($VendorKeywords -join '|'))
                }

$ActionTaken = @()

foreach ($User in $VendorUsers) {
    if ($User.LastLogonDate -lt $TimeThreshold -or $null -eq $User.LastLogonDate) {
        Write-Host "[!] Disabling inactive account: $($User.SamAccountName) (Last Logon: $($User.LastLogonDate))" -ForegroundColor Yellow
        try {
            Disable-ADAccount -Identity $User.SamAccountName
            $ActionTaken += [PSCustomObject]@{
                Username = $User.SamAccountName
                Status = 'Disabled'
                Reason = 'Inactive > 90 days'
            }
        }
        catch {
            Write-Host "[-] Failed to disable $($User.SamAccountName): $_" -ForegroundColor Red
        }
    }
}

if ($ActionTaken.Count -gt 0) {
    $ActionTaken | Export-Csv -Path $ReportPath -NoTypeInformation
    Write-Host "[*] Audit complete. Report saved to $ReportPath"
} else {
    Write-Host "[*] No inactive vendor accounts found."
}