Hunt playbook
Vendor Account Misuse
Verify that third-party accounts are used only within approved scope, time and destination.
IntermediateT0886T0822
Hypothesis
A vendor account may be used outside its approved window, scope or destination.
Why this hunt matters
Vendor access is often permanent, shared and under-monitored — an attractive and repeatedly abused path.
Scope
Assets: remote-access-gateway, jump-server, dcs, plc
Protocols:
Data sources required
- Remote access logs
- Identity provider logs
- Contract/work-order records
- Jump host session records
Baseline needed first
- Vendor accounts disabled by default and enabled per approved work order
Hunt steps
- 01List all vendor account authentications and sessions for the period
- 02Match each to an approved work order and window
- 03Compare destinations reached with the vendor's supported systems
- 04Identify accounts that remain permanently enabled
Indicators of interest
- Sessions with no work order
- Access to systems outside the vendor's scope
- Shared account with multiple concurrent sessions
- Access after contract end
Triage
- Which individual used the account?
- What actions were performed?
- Was any control-affecting change made?
Likely false positives
- Emergency support arranged verbally
- Multi-engineer support sessions
Escalation
- Access outside scope
- Any configuration change without a record
Containment options
- Disable the account; coordinate with operations if support is active
Validation
- Default-off vendor access implemented
- Named vendor identities enforced
- Scope restrictions in the gateway
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.