Canvas LMS Data Extortion: ShinyHunters Incident Analysis and Detection Strategies

---
title: Potential Canvas LMS Data Scraping via API
id: 8f2c3d1e-4b5a-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects potential bulk data exfiltration from Canvas LMS by identifying high-frequency GET requests to API endpoints commonly used for exporting user or course data.
references:
  - https://community.canvaslms.com/t5/Canvas-Admin-Guide/How-do-I-view-API-tokens-in-the-user-details-page/ta-p/253
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: webserver
  product: canvas
detection:
  selection:
    c-uri|contains:
      - '/api/v1/users/'
      - '/api/v1/courses/'
      - '/api/v1/accounts/'
    cs-method: GET
  timeframe: 5m
  condition: selection | count() > 100
falsepositives:
  - Legitimate administrative bulk exports during semester start/end
level: high
---
title: Canvas Access via Non-Browser User Agent
id: 9a3d4e2f-5c6b-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects access to Canvas LMS endpoints using automation tools (Python-requests, curl, wget) which may indicate scripted data scraping by threat actors like ShinyHunters.
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: proxy
  product: any
detection:
  selection_target:
    cs-host|contains:
      - 'instructure.com'
      - 'canvas.instructure.com'
      - '.canvaslms.com'
  selection_ua:
    cs-user-agent|contains:
      - 'python-requests'
      - 'curl/'
      - 'wget/'
      - 'libwww-perl'
  condition: all of selection_*
falsepositives:
  - Legitimate custom integrations using API tokens (filter by known IP ranges)
level: medium

// Hunt for anomalous volume of Canvas API access or risky sign-ins
let CanvasApps = dynamic(["Canvas", "Instructure"]);
// Query SigninLogs for Risky Sign-ins to Canvas
SigninLogs
| where AppDisplayName in~ CanvasApps
| where RiskLevelDuringSignIn in ("high", "medium")
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, RiskDetail, RiskLevelDuringSignIn
| union (
    // Query Proxy/CEF logs for high volume API hits
    CommonSecurityLog
    | where RequestURL contains "/api/v1/"
    | where RequestURL contains_any ("users", "courses", "accounts", "submissions")
    | summarize count() by SourceUserID, DestinationIP, bin(TimeGenerated, 5m)
    | where count_ > 50 // Threshold for suspicious bulk activity
    | project TimeGenerated, SourceUserID, DestinationIP, count_
)
| order by TimeGenerated desc

-- Hunt for processes communicating with Canvas domains or common scraping tools
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'python.exe'
   OR Name =~ 'python3.exe'
   OR Name =~ 'curl.exe'
   OR Name =~ 'wget.exe'
   OR Name =~ 'powershell.exe'

// JOIN with network connections to filter for Canvas traffic
LET CanvasProcesses = SELECT Pid FROM pslist() WHERE Name =~ 'python.exe' OR Name =~ 'curl.exe' OR Name =~ 'powershell.exe'

SELECT P.Pid, P.Name, P.CommandLine, N.RemoteAddress, N.RemotePort
FROM foreach(CanvasProcesses, {
    SELECT * FROM pslist(pid=Pid) AS P
    JOIN netstat(pid=Pid) AS N ON P.Pid = N.Pid
})
WHERE N.RemoteAddress =~ 'instructure.com' 
   OR N.RemoteAddress =~ 'canvaslms.com'

<#
.SYNOPSIS
    Audit Script for Canvas Data Scraping Artifacts
.DESCRIPTION
    Searches User Profiles for bulk-exported Canvas data (CSV/JSON) which may indicate a breach.
#>

$UserProfiles = Get-ChildItem "C:\Users\" -Directory
$SuspiciousExtensions = @("*.csv", "*.", "*.xlsx")
$CanvasKeywords = @("canvas", "instructure", "gradebook", "student_data", "course_export")

Write-Host "[+] Starting Canvas Artifact Audit..." -ForegroundColor Cyan

foreach ($Profile in $UserProfiles) {
    $Path = $Profile.FullName
    # Check common temp and download directories
    $TargetDirs = @(
        "$Path\Downloads",
        "$Path\Desktop",
        "$Path\AppData\Local\Temp"
    )

    foreach ($Dir in $TargetDirs) {
        if (Test-Path $Dir) {
            Write-Host "    Scanning $Dir..." -ForegroundColor Gray
            Get-ChildItem -Path $Dir -Recurse -Include $SuspiciousExtensions -ErrorAction SilentlyContinue | 
            Where-Object { 
                $_.Length -gt 1MB -and 
                (Select-String -Path $_.FullName -Pattern $CanvasKeywords -Quiet -ErrorAction SilentlyContinue)
            } | 
            Select-Object FullName, LastWriteTime, Length, @{Name='Owner';Expression={$Profile.Name}}
        }
    }
}

Write-Host "[+] Audit Complete. Review the output for suspicious bulk exports." -ForegroundColor Green