Third-Party Breaches in Education: Mitigating Vendor Supply Chain Attacks

---
title: Potential Data Exfiltration via Web Admin Interfaces
id: 9e8c7d6e-5f4a-4b3c-8a9b-1c2d3e4f5a6b
status: experimental
description: Detects potential bulk data export or exfiltration from web management interfaces (often used by vendors for SIS/LMS admin) via command-line tools like curl or wget.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
  selection_keywords:
    CommandLine|contains:
      - 'StudentData'
      - 'EnrollmentExport'
      - '-outfile'
      - '-OutFile'
  condition: selection_tools and selection_keywords
falsepositives:
  - Legitimate administrative data backups or exports
level: high
---
title: Suspicious Vendor Account Remote Access
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects RDP or VPN connections initiated from processes typically associated with vendor support tools or scripts, which may indicate misuse of vendor access.
references:
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.lateral_movement
  - attack.t1021.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 3389
      - 443
  selection_img:
    Image|contains:
      - 'teamviewer'
      - 'anydesk'
      - 'supremo'
  filter_legit:
    User|contains:
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_port and selection_img and not filter_legit
falsepositives:
  - Authorized vendor remote support sessions
level: medium

SigninLogs
| where ResultType == 0
| extend UserPrincipalName = tolower(UserPrincipalName)
| join kind=inner (
    // List of known vendor domains or UPN suffixes
    datatable(Domain:string)["@vendor-support.com", "@external-it-partner.net", "@trusted-edu-tech.org"]
) on $left.UserPrincipalName endswith $right.Domain
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, DeviceDetail, Status
| join kind=inner (
    // Look for high volume data export activities within 30 mins of login
    AuditLogs
    | where OperationName in ("ExportData", "DownloadReport", "SearchRole")
    | project AuditTime=TimeGenerated, UserId, OperationName
    | summarize ExportCount=count() by UserId, bin(AuditTime, 30m)
    | where ExportCount > 50 // Threshold for bulk export
) on $left.UserPrincipalName == $right.UserId
| where TimeGenerated between ((AuditTime-30m)..(AuditTime+30m))
| project TimeGenerated, UserPrincipalName, IPAddress, Location, ExportCount, AuditTime
| order by TimeGenerated desc

-- Hunt for suspicious network connections on endpoints
SELECT Pid, Name, Exe, Cmdline, RemoteAddress, RemotePort, State
FROM netstat()
WHERE RemoteAddress != '127.0.0.1' 
  AND RemoteAddress != '::1'
  AND RemotePort NOT IN (80, 443, 22, 53)
  -- Filter out common system binaries
  AND Name NOT IN ('svchost.exe', 'system', 'lsass.exe', 'services.exe')
  -- Look for vendor-named binaries or paths in temp
  AND (Exe =~ 'C:\\Temp\\%' OR Name =~ 'support%' OR Name =~ 'connect%')

# Audit Vendor/Guest Accounts for Stale Access and MFA Status
# Note: Requires AzureAD or Microsoft Graph modules for Entra ID context

$VendorGroups = @("Vendor-Admins", "External-Support", "SIS-Contractors")
$StaleDays = 90
$Today = Get-Date

Write-Host "[+] Starting Vendor Account Audit..." -ForegroundColor Cyan

foreach ($Group in $VendorGroups) {
    try {
        $Members = Get-ADGroupMember -Identity $Group -Recursive -ErrorAction Stop
        
        foreach ($Member in $Members) {
            if ($Member.ObjectClass -eq 'user') {
                $User = Get-ADUser -Identity $Member.SamAccountName -Properties LastLogonDate, Enabled, PasswordLastSet
                
                # Check if account is stale
                $DaysSinceLogon = if ($User.LastLogonDate) { ($Today - $User.LastLogonDate).Days } else { 999 }
                
                # Check for basic password age (hygiene indicator)
                $PasswordAge = ($Today - $User.PasswordLastSet).Days

                if ($User.Enabled -eq $true -and $DaysSinceLogon -gt $StaleDays) {
                    Write-Host "[!] STALE ACCOUNT FOUND: $($User.SamAccountName) | Last Logon: $($User.LastLogonDate) | Group: $Group" -ForegroundColor Yellow
                    
                    # Action: Disable if safe to do so (Commented out for safety)
                    # Disable-ADAccount -Identity $User.SamAccountName
                    # Write-Host "[+] Disabled account: $($User.SamAccountName)" -ForegroundColor Green
                }
                elseif ($PasswordAge -gt 365) {
                    Write-Host "[!] OLD PASSWORD: $($User.SamAccountName) | Age: $PasswordAge days" -ForegroundColor DarkYellow
                }
            }
        }
    }
    catch {
        Write-Host "[-] Could not find or access group: $Group" -ForegroundColor Red
    }
}

Write-Host "[+] Audit complete. Review findings for potential decommissioning." -ForegroundColor Cyan