Canvas LMS Breach: Defacement and Data Extortion — Detection and Response Guide

---
title: Canvas LMS - Web Server Process Spawning Shell
id: 8a4b2c1d-9e6f-4a3b-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects potential web shell activity where the web server process (Apache/Nginx/Passenger) spawns a shell process, commonly used to deface sites or steal data.
references:
  - https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/passenger'
      - '/ruby' # Canvas is Ruby on Rails
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate administrative scripting by developers (rare in prod)
level: critical
---
title: Canvas LMS - Suspicious File Modification in Web Root
description: Detects modifications to core Canvas view files or login assets within the web root, indicative of defacement activity.
id: 9d5c3e2f-0a7b-4c5d-9e8f-1a2b3c4d5e6f
status: experimental
references:
  - https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.defacement
  - attack.t1565
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '/app/views/login'
      - '/public/javascripts'
      - '/app/views/shared'
    TargetFilename|endswith:
      - '.html.erb'
      - '.js'
      - '.html'
  condition: selection
falsepositives:
  - Official platform updates or hotfixes
level: high

// Hunt for web server processes spawning shells or unusual scripts
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in ("httpd", "apache2", "nginx", "ruby", "passenger")
| where FileName in ("sh", "bash", "python", "perl", "php", "nc")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc

// Check for file modifications in Linux environments via Syslog (if AuditD is enabled)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage contains "/app/views" or SyslogMessage contains "/public/"
| where SyslogMessage contains "rename" or SyslogMessage contains "create"
| extend FileDetails = extract(@"(?:path=)([^\s]+)", 1, SyslogMessage)
| project TimeGenerated, HostName, ProcessName, FileDetails, SyslogMessage
| order by TimeGenerated desc

-- Hunt for recently modified files in Canvas web roots (Common paths)
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/**/app/views/**/*.erb")
WHERE Mtime > now() - 24h

-- Hunt for suspicious processes spawned by web servers
SELECT Name, Pid, Ppid, Exe, CommandLine, StartTime
FROM pslist()
WHERE Pid in (SELECT Pid FROM handles() WHERE Name =~ 'ruby' OR Name =~ 'apache') 
  AND (Name =~ 'sh' OR Name =~ 'bash' OR Name =~ 'python' OR Name =~ 'perl')

#!/bin/bash

CANVAS_DIR="/var/canvas" # Adjust to your installation path
BACKUP_DIR="/tmp/canvas_forensic_$(date +%Y%m%d_%H%M%S)"
LOG_FILE="/var/log/canvas_ir_audit.log"

# Create forensic backup of web root before cleaning
mkdir -p "$BACKUP_DIR"
if [ -d "$CANVAS_DIR" ]; then
    echo "[*] Creating forensic backup of $CANVAS_DIR to $BACKUP_DIR"
    cp -r "$CANVAS_DIR" "$BACKUP_DIR"
else
    echo "[!] Canvas directory $CANVAS_DIR not found. Please update CANVAS_DIR variable."
    exit 1
fi

echo "[*] Scanning for common web shell patterns..."
# Common web shell keywords (adjust based on environment needs)
grep -RlzE "eval\(|base64_decode|shell_exec|passthru|system\(|popen\(|proc_open" "$CANVAS_DIR/app/views" "$CANVAS_DIR/public" 2>/dev/null >> "$LOG_FILE"

if [ -s "$LOG_FILE" ]; then
    echo "[!] Potential web shells found. Review $LOG_FILE immediately."
    cat "$LOG_FILE"
else
    echo "[+] No obvious web shell signatures found in key directories."
fi

echo "[*] Checking for files modified in the last 48 hours in the web root..."
find "$CANVAS_DIR/app/views" -type f -mtime -2 -ls >> "$LOG_FILE"
find "$CANVAS_DIR/public" -type f -mtime -2 -ls >> "$LOG_FILE"

echo "[*] Remediation Steps Required:"
echo "1. Force rotation of all Canvas database credentials."
echo "2. Force password reset for ALL users (instructors and students)."
echo "3. Review logs for unauthorized admin sessions."
echo "4. Restore defaced files from clean backups (pre-breach)."
echo "5. Restrict outbound access from the Canvas server temporarily to stop data exfiltration."