UNFI & S5 Agency World: Technical Reccomendations

Assured’s vCISO suggests:

1. M1018 – User Account Management. Eliminate persistent or overprivileged third-party accounts integrated into supply systems.

• Disable interactive logon for vendor accounts:

  • GPO Path:
    Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
    Setting: Deny log on locally
    Value: <org> integration service accounts

• Automatically expire dormant third-party accounts:

  • net user <org>_sync /expires:06/30/2025

2. M1026 – Privileged Account Management. Harden and contain elevated permissions used by third-party integrations:

• Constrain logon times for integration accounts:

  • • net user <org>_sync /times:M-F,06:00-20:00

• Limit logon from specific IPs only (via Windows Firewall with Advanced Security):

  • • GPO Path:
      Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Inbound Rules
      Rule: Allow inbound traffic only from <org> IP ranges to port 443 (HTTPS)

3. M1047 – Audits. Track all actions taken by supply chain-linked service accounts.

• Enable auditing of service account logon attempts:

  • • Intune Settings Catalog:
      Audit Logon Events → Configure "Success" and "Failure"

• Include command-line in process creation auditing:

  • • Intune Settings Catalog:
      Setting: "Include command line in process creation events"
      Value: Enabled

4. M1042 – Disable or Remove Feature or Program. Restrict ability of compromised third-party accounts to execute arbitrary tools.:

• Set PowerShell policy to “AllSigned”:

  • • Intune > Device Configuration Profile > PowerShell Execution Policy
      Value: AllSigned

• Block command-line tools for third-party accounts via AppLocker:

  • • Rule: Deny > User: <org>_sync > Path: C:\Windows\System32\cmd.exe

5. M1038 – Execution Prevention. Prevent script execution from temp directories used in supply chain APIs or tooling:

• Block scripts from %TEMP% for vendor accounts:

  • • • Intune > Device Configuration Profile > PowerShell Execution Policy
        Value: AllSigned

• Disable Office macros for shared Excel-based integration:

  • • • Registry:
        [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security]
        "VBAWarnings"=dword:00000004

6. M1032 – Multi-factor Authentication. Protect integration dashboards and portals exposed to UNFI teams:

• Enforce MFA for all vendor identities:

  • • • Conditional Access Policy:
        Assign to: Group “UNFI_Accounts”
        Control: Require MFA

• Block legacy auth methods (POP, IMAP, etc):

  • • • Conditional Access → Client App Conditions → Block legacy authentication clients

Assured’s vCISO suggests:

Even with their infancy, we’ve looked into Bert’s TTPs and IOCs so we can provide advice on monitoring and protection measures, of which we have included some below. We mapped Bert’s TTPs to MITRE and generated this set of tactical guidance to clients to help them protect themselves from a similar attack.