Unit 4: Users and groups · Lesson 5 of 7 · 22 min
Case file: the account nobody used
One unused VPN account without MFA shut down a pipeline. Find the same mistake in the shop's VPN export.
mission
- You are
- You are reviewing remote access accounts.
- Situation
- IT exported every VPN account and one day of VPN logins into /srv/cases/vpn.
- Goal
- Find accounts that are active, have no MFA and have not been used for months, then check whether one was used anyway.
- Hand in
- A list of accounts to disable today, with the evidence.
case file
Colonial Pipeline Legacy VPN Account
Colonial Pipeline · 2021
In May 2021 DarkSide ransomware affiliates disrupted Colonial Pipeline, which halted pipeline operations for nearly a week and paid a $4.4 million ransom. The CEO testified to the US Senate that attackers entered on or around 29 April through a legacy VPN profile that was no longer in use but still active and protected only by a password, with no multifactor authentication. The password was later found in a batch of leaked credentials, suggesting reuse, though how it was obtained was not determined.
What went wrong
A dormant but active remote access account that required only a password and was not covered by MFA or account lifecycle reviews.
What would have stopped it
- Enforce MFA on all remote access, with no legacy exceptions
- Account lifecycle management that disables unused VPN profiles and accounts
- Monitor for organizational credentials appearing in breach dumps and force resets
- Segment IT from operational technology so IT ransomware does not force OT shutdown
What defenders could have seen
- Successful VPN login on an account with no recent activity
- VPN authentication without an MFA event recorded
- Credential exposure alerts from breach monitoring services
An account's life
- CreatedSomeone needs access
- UsedLogins show it is needed
- ForgottenThe person or project moves on
- DisabledA review catches it
- DeletedAfter a waiting period
Read the export
head -n 4 accounts.csv user,status,mfa,created,last_login,owner a.khan,active,push,2022-03-01,2026-10-21,a.khan b.osei,active,fido2,2023-01-17,2026-10-21,b.osei c.lindqvist,active,push,2021-09-12,2026-10-20,c.lindqvist grep -c . accounts.csv 12
you should see A header and eleven accounts.
Active accounts without MFA
awk -F, '$2 == "active" && $3 == "none"' accounts.csv
legacy-vpn-ops,active,none,2019-07-22,2025-03-02,unknown
svc-monitor,active,none,2022-01-10,2026-10-21,it-ops
you should see Two. svc-monitor is a service account in daily use. legacy-vpn-ops has no known owner.
Active accounts not used for six months
ISO dates sort as text, so a plain string comparison finds everything older than a date.
awk -F, 'NR > 1 && $2 == "active" && $5 < "2026-04-22" {print $1, $5}' accounts.csv
legacy-vpn-ops 2025-03-02
you should see legacy-vpn-ops, last used in March 2025.
Was it used anyway?
grep legacy-vpn-ops vpn-auth-2026-10-09.log
2026-10-09T10:08:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T10:27:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T10:48:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T18:24:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=success
you should see Three failures and then a success from an outside address, with only a password.
defender tip A dormant account that suddenly logs in is a high-priority alert, not a curiosity.
The same account, two reviews
legacy-vpn-ops active mfa=none last_login 2025-03-02 owner unknown
Valid for years, one password away from the network
legacy-vpn-ops disabled 2025-06-30 reason: no owner, unused 90 days
Nothing left to log in with
What a defender takes away
- 1Every account needs an owner and a last-used date.
- 2Disable what has not been used in 90 days.
- 3Remote access requires MFA with no exceptions for old profiles.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.