ADT Breach: ShinyHunters Legacy Credential Compromise and Data Exfiltration — IR Guide

---
title: Potential Database Dump via Web Service Account
id: 8a1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects execution of common database dumping utilities (mysqldump, pg_dump) by accounts associated with web services (www-data, apache, IUSR), which may indicate credential theft leading to data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2024/08/28
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/mysqldump'
      - '/pg_dump'
      - '/sqlcmd'
  filter_legit_admin:
    User|contains:
      - 'root'
      - 'admin'
      - 'postgres'
  filter_web_user:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'IUSR'
      - 'IIS AppPool'
  condition: selection and not filter_legit_admin and filter_web_user
falsepositives:
  - Legitimate backup scripts run by web accounts (rare)
level: high
---
title: High Volume HTTP Response Size (Potential Exfil)
id: 9b2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects HTTP responses with unusually high content sizes originating from legacy endpoints, indicative of bulk data download or database dumping.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2024/08/28
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: webserver
  product: nginx
  # Also applicable for apache, iis, or proxy via appropriate fields
detection:
  selection:
    sc_status: 200
    body_bytes_sent|gt: 10000000 # 10MB threshold
  filter_static:
    uri|contains:
      - '.jpg'
      - '.png'
      - '.mp4'
      - '.zip'
  condition: selection and not filter_static
falsepositives:
  - Legitimate large file downloads (software updates, media)
level: medium

// Hunt for successful logins to legacy systems from anomalous locations or sources
// Adjust 'LegacyAppResourceId' and 'TargetAccount' to your environment
let LegacySignins =
    SigninLogs
    | where AppDisplayName has "Legacy" or AppDisplayName has "CustomerDB" // Customize App Name
    | where ResultType == 0;
let FailedSignins =
    SigninLogs
    | where AppDisplayName has "Legacy" or AppDisplayName has "CustomerDB"
    | where ResultType in (50126, 50053, 50055); // Invalid creds, account locked, password expired
// Detect "Spraying" pattern: Multiple IPs failing, then one succeeding
LegacySignins
| join kind=inner (
    FailedSignins
    | summarize FailedCount=count(), FailedIPs=make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
) on UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedCount > 5
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType, FailedIPs, FailedCount
| extend Timestamp=TimeGenerated

-- Hunt for processes associated with data exfiltration tools
-- and recent SSH sessions which might indicate lateral movement to legacy systems
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name IN ('mysqldump', 'pg_dump', 'sqlplus', 'sqlcmd', 'scp', 'rsync')
   OR CommandLine =~ 'password'
   OR CommandLine =~ 'secret'

-- Check for recent large file modifications in web directories
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/*/var/www/html/**/*')
WHERE Mtime > now() - 24h AND Size > 10000000

#!/bin/bash
# Remediation: Audit Legacy System Access and Suspend Suspect Accounts
# Usage: sudo ./audit_legacy_access.sh

echo "[+] Auditing recent successful logins (last 2 days)..."
last -n 100 -t today | head -n 20

echo "[+] Checking for active database dump processes..."
if pgrep -x "mysqldump" > /dev/null; then
    echo "[!] WARNING: mysqldump is currently running. Investigate PID:"
    ps aux | grep mysqldump | grep -v grep
else
    echo "[+] No mysqldump processes detected."
fi

if pgrep -x "pg_dump" > /dev/null; then
    echo "[!] WARNING: pg_dump is currently running. Investigate PID:"
    ps aux | grep pg_dump | grep -v grep
else
    echo "[+] No pg_dump processes detected."
fi

echo "[+] Listing web root files modified in the last 48 hours..."
# Adjust /var/www/html to your legacy web root
find /var/www/html -type f -mtime -2 -ls

echo "[+] Remediation Recommendation:"
echo "1. Immediately rotate credentials for all service accounts on legacy systems."
echo "2. Enforce MFA for all administrative and legacy application access."
echo "3. Isolate legacy systems from the internet if not strictly required."