Charter Communications Breach: ShinyHunters, 4.9M Records, and Defending Against Credential Stuffing

---
title: Potential Credential Stuffing Attack - High Failure Rate
id: 8a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects a high frequency of failed authentication attempts from a single source, indicative of credential stuffing or brute force attacks similar to techniques used by ShinyHunters.
references:
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2024/04/24
tags:
  - attack.credential_access
  - attack.t1110.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4625
  filter:
    TargetUserName|contains:
      - 'Administrator'
      - 'Admin'
  condition: selection | not filter | count() by IpAddress > 50
falsepositives:
  - Misconfigured service accounts
  - Password spraying during authorized audits
level: high
---
title: Suspicious User Agent - Headless Chrome/Selenium
id: 9b4f2d93-0f5c-4e6a-9c11-4f6b7e0a1b2c
status: experimental
description: Detects process execution or network connections associated with headless browsers and automation tools (Selenium, Puppeteer) often used for large-scale account scraping and data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2024/04/24
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'HeadlessChrome'
      - '--headless'
      - 'selenium'
      - 'puppeteer'
  condition: selection
falsepositives:
  - Legitimate automated testing by developers
level: medium
---
title: High Volume Outbound Network Traffic - Potential Data Exfil
id: 1c5e3a7d-8f9b-4c2d-a1e3-5f6b7c8d9e0a
status: experimental
description: Detects significant outbound data transfer to non-corporate IPs, which could indicate exfiltration of bulk data like customer records.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2024/04/24
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|between:
      - 443
      - 80
    Initiated: 'true'
  timeframe: 5m
  condition: selection | count() by DestinationIp > 1000
falsepositives:
  - Cloud backups
  - Video streaming
  - Software updates
level: medium

// Hunt for successful logins followed immediately by high-volume API calls or data access
// This mimics the behavior of an actor logging in and scraping data (as seen in the Charter breach)
let HighRiskLogins = SigninLogs
| where ResultType == 0
| where RiskLevelDuringSignIn in ("high", "medium")
| project AccountObjectId, UserPrincipalName, AppId, SignInTime;
SigninLogs
| where ResultType == 0
| join kind=inner HighRiskLogins on AccountObjectId
| extend TimeDelta = SignInTime1 - SignInTime
| where TimeDelta between(-10s..10s)
| summarize Count = count() by UserPrincipalName, AppId, bin(SignInTime, 1h)
| where Count > 50 // Threshold for bulk activity
| order by Count desc

-- Hunt for processes making HTTP requests using automation libraries (Python/Node/PowerShell)
-- This detects the automated scraping tools likely used by ShinyHunters
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name IN ('python.exe', 'python3.exe', 'node.exe', 'powershell.exe', 'pwsh.exe')
  AND (
    CommandLine =~ 'requests' OR
    CommandLine =~ 'http' OR
    CommandLine =~ 'Invoke-WebRequest' OR
    CommandLine =~ 'wget'
  )
-- Filter for processes with high handle counts or memory usage indicative of scraping
GROUP BY Pid

# Script to Audit for Potential Brute Force Indicators on Local AD/Environment
# Requires Active Directory Module

Import-Module ActiveDirectory

$Threshold = 50
$TimeFrame = (Get-Date).AddHours(-24)

$Events = Get-WinEvent -FilterHashtable @{
    LogName='Security';
    Id=4625;
    StartTime=$TimeFrame
} -ErrorAction SilentlyContinue

if ($Events) {
    $Attackers = $Events | Group-Object -Property {$_.Properties[19].Value} | Where-Object {$_.Count -gt $Threshold}
    
    if ($Attackers) {
        Write-Host "[!] Potential Credential Stuffing Detected:" -ForegroundColor Red
        foreach ($Attacker in $Attackers) {
            Write-Host "Source IP: $($Attacker.Name) | Failed Attempts: $($Attacker.Count)" -ForegroundColor Yellow
            # Optional: Block IP in Windows Firewall if applicable
            # New-NetFirewallRule -DisplayName "Block IP $Attacker.Name" -Direction Inbound -RemoteAddress $Attacker.Name -Action Block
        }
    } else {
        Write-Host "No indicators of credential stuffing found above threshold." -ForegroundColor Green
    }
} else {
    Write-Host "No failed login events found in the last 24 hours." -ForegroundColor Cyan
}