Unit 1: Identities are the new perimeter · Lesson 3 of 4 · 22 min

Find the forgotten accounts

Contractors who left, service accounts with no owner and keys that never expire: the identities attackers love.

mission

You are
You are the identity engineer running Kestrel's first access review.
Situation
Leavers and old integrations pile up in every directory. Each one is a working login that nobody would miss if it were misused.
Goal
Find the accounts and keys that should not still work.
Hand in
A cleanup list your manager can approve.

case file

Colonial Pipeline Legacy VPN Account

Colonial Pipeline · 2021

In May 2021 DarkSide ransomware affiliates disrupted Colonial Pipeline, which halted pipeline operations for nearly a week and paid a $4.4 million ransom. The CEO testified to the US Senate that attackers entered on or around 29 April through a legacy VPN profile that was no longer in use but still active and protected only by a password, with no multifactor authentication. The password was later found in a batch of leaked credentials, suggesting reuse, though how it was obtained was not determined.

What went wrong

A dormant but active remote access account that required only a password and was not covered by MFA or account lifecycle reviews.

What would have stopped it

  • Enforce MFA on all remote access, with no legacy exceptions
  • Account lifecycle management that disables unused VPN profiles and accounts
  • Monitor for organizational credentials appearing in breach dumps and force resets
  • Segment IT from operational technology so IT ransomware does not force OT shutdown

What defenders could have seen

  • Successful VPN login on an account with no recent activity
  • VPN authentication without an MFA event recorded
  • Credential exposure alerts from breach monitoring services

sourcesthehackernews.comusa.inquirer.net

01

Find contractors past their end date

In People, filter for Contractor and compare each End date with today, 16 March 2026.

you should see Three contractors are still Active after their end date. One leaver was disabled correctly.

02

Find service accounts with no owner

In Service accounts, filter for (none).

you should see Two accounts. No owner means nobody rotates them and nobody notices them.

defender tip Every service account needs a named owner and a review date. Unowned accounts are disabled first and deleted after a quiet period.

03

Find the account that should never sign in

Look at Interactive sign-in and Last rotated together.

you should see svc-backup allows interactive sign-in with a password last changed in 2019.

04

Find the oldest admin key

In Tokens and keys, sort by Created.

you should see cloud-admin-old: an AdministratorAccess key from 2022 that never expires and was last used in 2025.

Offboarding

Today
HR updates end date
Account stays Active
Tokens keep working

Access outlives the contract.

Fixed
HR end date triggers disable
Sessions and tokens revoked
Owner confirms service accounts quarterly

Access ends when the reason for it ends.

What a defender takes away

  1. 1Accounts must end when the job ends, automatically.
  2. 2Unowned service accounts and never-expiring keys are cleanup priority one.
  3. 3Colonial Pipeline was entered through one inactive account with no MFA.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.