Session log: Dataforth security incident, MFA rollout, test datasheet investigation

- DF-JOEL2 compromised via ScreenConnect social engineering (Angel Raya)
- C2 IPs blocked, rogue clients removed, M365 sessions revoked, password reset
- IC3 complaint filed, abuse reports sent to Virtuo and ConnectWise
- Conditional Access policies deployed (MFA, block foreign, block legacy auth)
- 38 stale test station accounts deleted from Entra
- Test datasheet pipeline investigated - data exists in DB, export step broken
- TestDataSheetUploader source code extracted for analysis

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.vb

@@ -0,0 +1,7 @@
+' <autogenerated/>
+            Option Strict Off
+            Option Explicit On
+
+            Imports System
+            Imports System.Reflection
+            <Assembly: Global.System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName:=".NET Framework 4.7.2")>

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Debug/TestDataSheetUploader.vbproj.CoreCompileInputs.cache

@@ -0,0 +1 @@
+ff0a48e8544663eb773da2d9d956c2efd790e83a

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Debug/TestDataSheetUploader.vbproj.FileListAbsolute.txt

@@ -0,0 +1,22 @@
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.exe.config
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.exe
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.pdb
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.xml
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.Resources.resources
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbproj.GenerateResource.Cache
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.exe
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.xml
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.pdb
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbprojResolveAssemblyReference.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.exe.config
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.exe
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.pdb
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Debug\TestDataSheetUploader.xml
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbproj.AssemblyReference.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbproj.SuggestedBindingRedirects.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.Resources.resources
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbproj.GenerateResource.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.vbproj.CoreCompileInputs.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.exe
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.xml
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Debug\TestDataSheetUploader.pdb

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Debug/TestDataSheetUploader.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<doc>
+<assembly>
+<name>
+TestDataSheetUploader
+</name>
+</assembly>
+<members>
+<member name="T:TestDataSheetUploader.My.Resources.Resources">
+<summary>
+  A strongly-typed resource class, for looking up localized strings, etc.
+</summary>
+</member>
+<member name="P:TestDataSheetUploader.My.Resources.Resources.ResourceManager">
+<summary>
+  Returns the cached ResourceManager instance used by this class.
+</summary>
+</member>
+<member name="P:TestDataSheetUploader.My.Resources.Resources.Culture">
+<summary>
+  Overrides the current thread's CurrentUICulture property for all
+  resource lookups using this strongly typed resource class.
+</summary>
+</member>
+</members>
+</doc>

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Release/.NETFramework,Version=v4.7.2.AssemblyAttributes.vb

@@ -0,0 +1,7 @@
+' <autogenerated/>
+            Option Strict Off
+            Option Explicit On
+
+            Imports System
+            Imports System.Reflection
+            <Assembly: Global.System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName:=".NET Framework 4.7.2")>

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Release/TestDataSheetUploader.vbproj.CoreCompileInputs.cache

@@ -0,0 +1 @@
+97dae5c7224d0c77b10fa6d035307499d50af816

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Release/TestDataSheetUploader.vbproj.FileListAbsolute.txt

@@ -0,0 +1,32 @@
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe.config
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.pdb
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.xml
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.Resources.resources
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.GenerateResource.Cache
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.exe
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.xml
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.pdb
+C:\Users\hoffm\Documents\Visual Studio 2015\Projects\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbprojResolveAssemblyReference.cache
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe.config
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.exe
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.xml
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.pdb
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.pdb
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.xml
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbprojResolveAssemblyReference.cache
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.Resources.resources
+C:\Users\hoffm\source\repos\Dataforth\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.GenerateResource.Cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe.config
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.exe
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.pdb
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\bin\Release\TestDataSheetUploader.xml
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.AssemblyReference.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.SuggestedBindingRedirects.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.Resources.resources
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.GenerateResource.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.vbproj.CoreCompileInputs.cache
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.exe
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.xml
+C:\Users\kennethhoffman\source\repos\dataforth-enterprise\TestDataSheetUploader\TestDataSheetUploader\obj\Release\TestDataSheetUploader.pdb

clients/dataforth/dos-test-machines/Test Datasheets/TestDataSheetUploader/TestDataSheetUploader/obj/Release/TestDataSheetUploader.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<doc>
+<assembly>
+<name>
+TestDataSheetUploader
+</name>
+</assembly>
+<members>
+<member name="T:TestDataSheetUploader.My.Resources.Resources">
+<summary>
+  A strongly-typed resource class, for looking up localized strings, etc.
+</summary>
+</member>
+<member name="P:TestDataSheetUploader.My.Resources.Resources.ResourceManager">
+<summary>
+  Returns the cached ResourceManager instance used by this class.
+</summary>
+</member>
+<member name="P:TestDataSheetUploader.My.Resources.Resources.Culture">
+<summary>
+  Overrides the current thread's CurrentUICulture property for all
+  resource lookups using this strongly typed resource class.
+</summary>
+</member>
+</members>
+</doc>