Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld
https://sockanalyst.com/patch-now/efs-coolworld-plasma-freezer-setpoint-tampering

Splunk
index=vpn OR index=remote_access (user="*coolworld*" OR vendor_account=true)
| eval hour=strftime(_time,"%H")
| where hour<7 OR hour>19
| stats count min(_time) as first max(_time) as last by user, src_ip, dest

Sentinel
// Off-hours vendor remote access (tag vendor accounts in a watchlist named VendorAccounts)
let vendors = _GetWatchlist('VendorAccounts') | project SearchKey;
SigninLogs
| where UserPrincipalName in (vendors) and ResultType == 0
| extend Hour = datetime_part("hour", TimeGenerated)
| where Hour < 7 or Hour > 19
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location