Unit 4: Users and groups · Lesson 5 of 7 · 22 min
Case file: the account nobody used
One unused VPN account without MFA shut down a pipeline. Find the same mistake in the shop's VPN export.
mission
- You are
- You are reviewing remote access accounts.
- Situation
- IT exported every VPN account and one day of VPN logins into /srv/cases/vpn.
- Goal
- Find accounts that are active, have no MFA and have not been used for months, then check whether one was used anyway.
- Hand in
- A list of accounts to disable today, with the evidence.
case file
Colonial Pipeline Legacy VPN Account
Colonial Pipeline · 2021
In May 2021 DarkSide ransomware affiliates disrupted Colonial Pipeline, which halted pipeline operations for nearly a week and paid a $4.4 million ransom. The CEO testified to the US Senate that attackers entered on or around 29 April through a legacy VPN profile that was no longer in use but still active and protected only by a password, with no multifactor authentication. The password was later found in a batch of leaked credentials, suggesting reuse, though how it was obtained was not determined.
What went wrong
A dormant but active remote access account that required only a password and was not covered by MFA or account lifecycle reviews.
What would have stopped it
- Enforce MFA on all remote access, with no legacy exceptions
- Account lifecycle management that disables unused VPN profiles and accounts
- Monitor for organizational credentials appearing in breach dumps and force resets
- Segment IT from operational technology so IT ransomware does not force OT shutdown
What defenders could have seen
- Successful VPN login on an account with no recent activity
- VPN authentication without an MFA event recorded
- Credential exposure alerts from breach monitoring services
An account's life
- CreatedSomeone needs access
- UsedLogins show it is needed
- ForgottenThe person or project moves on
- DisabledA review catches it
- DeletedAfter a waiting period
Read the export
head -n 4 accounts.csv user,status,mfa,created,last_login,owner a.khan,active,push,2022-03-01,2026-10-21,a.khan b.osei,active,fido2,2023-01-17,2026-10-21,b.osei c.lindqvist,active,push,2021-09-12,2026-10-20,c.lindqvist grep -c . accounts.csv 12
you should see A header and eleven accounts.
head- Prints the first lines of a file or of piped text. Built into Linux and macOS.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
Active accounts without MFA
awk -F, '$2 == "active" && $3 == "none"' accounts.csv
legacy-vpn-ops,active,none,2019-07-22,2025-03-02,unknown
svc-monitor,active,none,2022-01-10,2026-10-21,it-ops
you should see Two. svc-monitor is a service account in daily use. legacy-vpn-ops has no known owner.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
Active accounts not used for six months
ISO dates sort as text, so a plain string comparison finds everything older than a date.
awk -F, 'NR > 1 && $2 == "active" && $5 < "2026-04-22" {print $1, $5}' accounts.csv
legacy-vpn-ops 2025-03-02
you should see legacy-vpn-ops, last used in March 2025.
Was it used anyway?
grep legacy-vpn-ops vpn-auth-2026-10-09.log
2026-10-09T10:08:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T10:27:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T10:48:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=failure
2026-10-09T18:24:00Z vpn01 auth: user=legacy-vpn-ops src=185.220.101.47 method=password mfa=not_required result=success
you should see Three failures and then a success from an outside address, with only a password.
defender tip A dormant account that suddenly logs in is a high-priority alert, not a curiosity.
The same account, two reviews
legacy-vpn-ops active mfa=none last_login 2025-03-02 owner unknown
Valid for years, one password away from the network
legacy-vpn-ops disabled 2025-06-30 reason: no owner, unused 90 days
Nothing left to log in with
What a defender takes away
- 1Every account needs an owner and a last-used date.
- 2Disable what has not been used in 90 days.
- 3Remote access requires MFA with no exceptions for old profiles.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.