FBI Strikes Back at ShinyHunters: Defending SaaS and Cloud Data Against OAuth Abuse and Extortion Campaigns

---
title: Suspicious OAuth Application Consent Grant in Entra ID
id: 8f2c1d94-3a6e-4b71-9c05-2e7d4a8f6b10
status: experimental
description: Detects user-level consent grants to OAuth applications, a technique used by ShinyHunters-aligned actors via vishing to gain delegated access to SaaS data without malware. Alert on any user consent when admin consent workflow is enforced.
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1078.004/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.initial_access
  - attack.t1078.004
  - attack.t1566
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
    InitiatedBy|contains: 'user'
falsepositives:
  - Developers consenting to internal line-of-business apps in tenants without enforced admin consent workflow
level: high
---
title: Data Exfiltration Tool Execution (rclone and SaaS Bulk Export Utilities)
id: 4b9e2f17-7d3a-4c56-8e21-9a0c5d7b3f48
status: experimental
description: Detects execution of rclone, Salesforce Data Loader CLI, or Snowflake snowsql on endpoints where such tooling is not baseline — consistent with staging and exfiltration of bulk SaaS exports in extortion campaigns.
references:
  - https://attack.mitre.org/techniques/T1567.002/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\dataloader.jar'
      - '\snowsql.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone sync'
      - 'sfdx force:data:bulk'
      - 'process.config'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate ETL pipelines and integration engineers — baseline by host and user before tuning severity
level: medium
---
title: New OAuth Token Issued Followed by High-Volume SaaS API Session
id: 1c7a3e85-2f94-4d6b-a318-6e0b9d4c7f52
status: experimental
description: Detects OAuth token issuance events correlated with subsequent anomalous API session establishment from unfamiliar network locations, matching the post-consent data access phase of SaaS extortion intrusions.
references:
  - https://attack.mitre.org/techniques/T1550.001/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AppDisplayName|contains:
      - 'Data Loader'
      - 'DataLoader'
    AuthenticationRequirement: 'singleFactorAuthentication'
  filter_known:
    IPAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter_known
falsepositives:
  - Remote integration service accounts — exclude known service principals by object ID
level: high

// Hunt: OAuth consent grants followed by anomalous SaaS sign-ins (Sentinel)
// Correlates Entra ID consent events with subsequent single-factor app sign-ins from new IPs
let ConsentEvents = AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant")
| extend User = tostring(InitiatedBy.user.userPrincipalName)
| extend TargetApp = tostring(TargetResources[0].displayName)
| extend ConsentTime = TimeGenerated
| project ConsentTime, User, TargetApp;
ConsentEvents
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(30d)
    | where AuthenticationRequirement == "singleFactorAuthentication"
    | project SigninTime = TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location
) on $left.User == $right.UserPrincipalName
| where SigninTime between (ConsentTime .. ConsentTime + 7d)
| summarize SigninCount = count(), DistinctIPs = dcount(IPAddress), IPs = make_set(IPAddress)
    by User, TargetApp, AppDisplayName
| where SigninCount > 50 or DistinctIPs > 2
| sort by SigninCount desc;

// Hunt: Bulk export / exfiltration tooling on endpoints (Defender)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rclone.exe", "snowsql.exe", "dataloader.exe")
   or ProcessCommandLine has_any ("rclone copy", "rclone sync", "force:data:bulk", "bulkapi")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
| sort by TimeGenerated desc;

-- Hunt for rclone binaries and bulk export staging artifacts on endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)rclone (copy|sync|move)'
   OR Exe =~ '(?i)(rclone|snowsql|dataloader)\.exe'

-- Separately enumerate rclone configs and recent large CSV exports in user profiles
SELECT FullPath, Size, Mtime
FROM glob(glob='C:/Users/*/.config/rclone/rclone.conf')

SELECT FullPath, Size, Mtime
FROM glob(glob='C:/Users/*/Downloads/**/*.csv')
WHERE Size > 10485760
  AND Mtime > Now() - 86400 * 7

# Audit and remediate risky OAuth consents in Entra ID
# Run as a Global Admin or Privileged Role Admin with MgGraph connected
Connect-MgGraph -Scopes "DelegatedPermissionGrant.ReadWrite.All","Application.Read.All","Directory.Read.All"

# Enumerate all user-level delegated permission grants
$grants = Get-MgOauth2PermissionGrant -All
$report = foreach ($g in $grants) {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId
    [PSCustomObject]@{
        AppName      = $sp.DisplayName
        ClientId     = $g.ClientId
        ConsentType  = $g.ConsentType
        Scope        = $g.Scope
        Created      = $sp.AppOwnerOrganizationId
    }
}
$report | Export-Csv -Path ".\OAuthConsentAudit.csv" -NoTypeInformation

# Flag grants with mail/data read scopes typical of extortion staging
$report | Where-Object { $_.Scope -match "Mail.Read|offline_access|full_access" -and $_.ConsentType -eq "Principal" }

# Revoke a confirmed malicious grant (replace with the grant Id from your audit)
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<grant-id>"

# Enforce the admin consent workflow so users can no longer self-consent
Update-MgPolicyAdminConsentRequestPolicy -BodyParameter @{ isEnabled = $true }
Write-Output "Admin consent workflow enforced. Review OAuthConsentAudit.csv for residual risk."