FulcrumSec Manchester Airports Group Breach: 86 GB Data Theft — Detection, Hardening, and Incident Response Guide

---
title: Suspicious Archive Creation in Non-Standard Directories (Data Staging)
id: 3f2c1a90-8e4d-4b7a-9c51-2d6f8a1b3e45
status: experimental
description: Detects creation of large compressed archives in ProgramData, Temp, or web-accessible directories, a common data staging behavior observed in extortion-driven breaches such as the MAG/FulcrumSec incident.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.7z'
      - '.rar'
      - '.zip'
      - '.tar.gz'
  selection_path:
    TargetFilename|contains:
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
      - '\inetpub\wwwroot\'
      - '\wwwroot\'
  filter_known:
    Image|endswith:
      - '\7zFM.exe'
    User|startswith: 'NT AUTHORITY\'
  condition: selection_ext and selection_path and not filter_known
falsepositives:
  - Backup software writing archives to temp directories
  - Application update packages
level: medium
---
title: Execution of Rclone or Cloud Exfiltration Tooling
id: 9b4e7d21-3c6a-4f58-b1d9-7a2e5c8f0d63
status: experimental
description: Detects execution of rclone or similar command-line cloud sync tools commonly abused for bulk data exfiltration in extortion campaigns.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\gdown.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--transfers'
      - 'mega.nz'
      - 'pcloud'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate cloud backup use of rclone (rare on servers; baseline your environment)
level: high
---
title: Compression Utility Invoked with Password or High-Compression Flags by Non-Interactive Account
id: 5c8a2f47-1d93-4e6b-a472-8f3d9b0e6c21
status: experimental
description: Detects 7-Zip or WinRAR invoked with password-protection or multi-volume flags, indicative of attacker-controlled archive staging prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
  selection_flags:
    CommandLine|contains:
      - ' -p'
      - ' -v'
      - ' -m5'
      - ' a -t7z'
      - ' a -trar'
  filter_software_dirs:
    CommandLine|contains:
      - '\backup\'
      - '\sccm\'
  condition: selection_img and selection_flags and not filter_software_dirs
falsepositives:
  - IT administrators creating encrypted archives for data transfer
  - Enterprise backup tooling
level: medium

// Hunt 1: Bulk archive staging followed by exfil tool execution on the same host
let lookback = 7d;
let stagingHosts = (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe")
    | where ProcessCommandLine has_any (" -p", " a -t", " -v")
    | summarize StagingFirstSeen=min(TimeGenerated) by DeviceName, InitiatingProcessAccountName);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("rclone.exe","megacmd.exe") or ProcessCommandLine has_any ("rclone copy","rclone sync","mega.nz","transfer.sh")
| join kind=inner stagingHosts on DeviceName
| project DeviceName, ExfilToolTime=TimeGenerated, FileName, ProcessCommandLine,
          InitiatingProcessAccountName, StagingFirstSeen
| sort by DeviceName asc;

// Hunt 2: Anomalous large outbound transfers from servers (86 GB leaves a footprint)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceType =~ "Server" or InitiatingProcessFileName in~ ("rclone.exe","curl.exe","powershell.exe","ftp.exe")
| where RemoteIPType =~ "Public"
| summarize TotalBytes=sum(tolong(todynamic(AdditionalFields).bytes_sent)),
            DistinctDestinations=dcount(RemoteIP),
            Processes=make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl
| where TotalBytes > 1000000000  // >1 GB to a single destination
| sort by TotalBytes desc;

// Hunt 3: New admin or service accounts touching booking/customer database servers
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID in (4624, 4672)
| where LogonType in (3, 10)  // network / remote interactive
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), LogonCount=count()
  by Account, Computer, IpAddress
| where LogonCount < 5  // rare account-to-host pairing
| sort by FirstSeen desc;

-- Hunt for data staging archives and exfiltration tool artifacts
-- Artifact: MAG-Extortion-Staging-Hunt

LET archives = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar',
  'C:/Windows/Temp/**/*.zip',
  'C:/inetpub/**/*.zip',
  'C:/Users/*/AppData/Local/Temp/**/*.7z'
])
WHERE Size > 50000000  -- archives >50MB warrant review

LET exfil_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)rclone|mega\.nz|pcloud|transfer\.sh|curl.*-T|scp .*@'
   OR Exe =~ '(?i)rclone\.exe|megacmd\.exe'

SELECT 'archive_staging' AS FindingType, FullPath AS Indicator,
       Size AS SizeBytes, Mtime AS Timestamp, NULL AS CommandLine
FROM archives
UNION ALL
SELECT 'exfil_process' AS FindingType, Exe AS Indicator,
       NULL AS SizeBytes, CreateTime AS Timestamp, CommandLine AS CommandLine
FROM exfil_procs

# MAG-Breach Hardening Audit: exfil tooling + egress exposure
# Run elevated on servers. Output to CSV for SOC review.

$report = @()

# 1. Find exfiltration-capable tools that have no business on servers
$suspectTools = @('rclone.exe','megacmd.exe','7z.exe','rar.exe','curl.exe','wget.exe','scp.exe','pscp.exe','winscp.exe')
foreach ($tool in $suspectTools) {
    Get-ChildItem -Path 'C:\' -Filter $tool -Recurse -ErrorAction SilentlyContinue -Force |
        Where-Object { $_.FullName -notmatch 'Windows\\(WinSxS|System32)' } |
        ForEach-Object {
            $report += [pscustomobject]@{
                Finding  = 'ExfilToolPresent'
                Path     = $_.FullName
                Modified = $_.LastWriteTime
                Host     = $env:COMPUTERNAME
            }
        }
}

# 2. Check Windows Firewall: is there ANY outbound deny policy, or wide-open egress?
$outboundDefault = (Get-NetFirewallProfile | Where-Object {$_.DefaultOutboundAction -eq 'Allow'}).Count
$report += [pscustomobject]@{
    Finding  = "EgressPolicy"
    Path     = "Profiles allowing all outbound: $outboundDefault of 3"
    Modified = (Get-Date)
    Host     = $env:COMPUTERNAME
}

# 3. List recent large archive files (>50MB) in staging-prone locations
$stagingPaths = @('C:\ProgramData','C:\Windows\Temp','C:\inetpub','C:\Temp')
foreach ($p in $stagingPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Include *.7z,*.rar,*.zip -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -gt 50MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            ForEach-Object {
                $report += [pscustomobject]@{
                    Finding  = 'RecentLargeArchive'
                    Path     = $_.FullName
                    Modified = $_.LastWriteTime
                    Host     = $env:COMPUTERNAME
                }
            }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\egress_audit_$env:COMPUTERNAME.csv" -NoTypeInformation

# 4. Baseline remediation: block common exfil destinations at the host firewall
#    (complement with egress filtering at the perimeter/proxy layer)
$blockHosts = @('mega.nz','transfer.sh','file.io','wetransfer.com','anonfiles.com')
foreach ($h in $blockHosts) {
    try {
        $ips = (Resolve-DnsName $h -Type A -ErrorAction Stop).IPAddress
        foreach ($ip in $ips) {
            New-NetFirewallRule -DisplayName "Block-Exfil-$h" -Direction Outbound `
                -Action Block -RemoteAddress $ip -ErrorAction SilentlyContinue | Out-Null
        }
    } catch { Write-Warning "Could not resolve $h" }
}
Write-Host "[+] Audit complete. Review CSV output and validate firewall blocks before production rollout."