Instructure Canvas Incident: Detecting Unauthorized Access and Data Exfiltration

---
title: Potential Canvas Data Scraping via Command Line
id: 8a3b2c11-7d4e-4a9f-8c1d-2e5f6a7b8c9d
status: experimental
description: Detects potential scraping of Canvas LMS data via command-line utilities like PowerShell or Python accessing known Canvas domains.
references:
  - https://community.canvaslms.com/t5/Canvas-Admin-Guide/How-do-I-use-the-API-Audit-Log/ta-p/141
author: Security Arsenal
date: 2024/10/16
tags:
  - attack.collection
  - attack.t1119
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\python.exe'
      - '\curl.exe'
      - '\wget.exe'
    CommandLine|contains:
      - 'instructure.com'
      - 'canvas.instructure.com'
      - 'api/v1/'
  condition: selection
falsepositives:
  - Legitimate administrative scripts or API testing by IT staff
level: medium
---
title: Suspicious Canvas Admin Login from Non-Corporate IP
id: 9b4c3d22-8e5f-5b0a-9d2e-3f6a7b8c9d0e
status: experimental
description: Detects successful logins to Canvas Admin panel from IP addresses not geolocated near the organization's HQ or known VPN ranges (requires Proxy or Firewall logs).
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2024/10/16
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: proxy
  product: firewall
detection:
  selection:
    c-uri|contains: '/accounts/'
    c-uri|contains: '/users/'
    sc-status: 200
    method: POST
  filter_known_admin_tools:
    c-useragent|contains:
      - 'Mozilla/5.0'
  # Note: IP filtering must be customized to the specific org's CIDR blocks in the implementation
  condition: selection and not filter_known_admin_tools
falsepositives:
  - Legitimate remote administration by traveling staff
level: high

// Hunt for bulk API calls to Canvas from a single user indicating potential scraping
let Lookback = 1d;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where ProcessCommandLine has_any("canvas", "instructure")
| where FileName in~ ("powershell.exe", "python.exe", "cmd.exe", "curl.exe")
| summarize count(), arg_max(Timestamp, *) by DeviceName, AccountName, InitiatingProcessFileName
| where count_ > 10 // Threshold for automation
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc
;

// Check Sign-in Logs for Canvas Admin failures (ATO precursors)
SigninLogs
| where AppDisplayName contains "Canvas"
| where ResultType == 50126 or ResultType == 50053 // Invalid password or Account locked
| summarize FailedAttempts = count() by UserPrincipalName, IPAddress, Location
| where FailedAttempts > 5
| project UserPrincipalName, IPAddress, Location, FailedAttempts

-- Hunt for non-browser processes connecting to Canvas domains
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name NOT IN ('chrome.exe', 'firefox.exe', 'msedge.exe', 'iexplore.exe', 'safari.exe')
  AND CommandLine =~ '(?i)instructure\.com'

# Audit for Canvas API Keys in Environment Variables
# Threat actors often dump keys for persistence or exfil

Write-Host "[+] Auditing Environment Variables for potential API tokens..."
$envVars = Get-ChildItem Env:
$regex = "(lti_key|api_token|canvas_access|consumer_key)"

$found = $false
foreach ($var in $envVars) {
    if ($var.Value -match $regex) {
        Write-Host "[!] Suspicious Variable Found: $($var.Name)" -ForegroundColor Yellow
        $found = $true
    }
}

if (-not $found) {
    Write-Host "[*] No obvious Canvas-related tokens in user environment variables."
}

# Check PowerShell Event Logs for Canvas related web requests in last 24 hours
Write-Host "[+] Checking PowerShell Script Block Logs for Canvas access..."
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue

if ($events) {
    foreach ($event in $events) {
        if ($event.Message -match 'instructure') {
            Write-Host "[!] Canvas-related script execution detected:" -ForegroundColor Red
            Write-Host $event.Message
        }
    }
} else {
    Write-Host "[*] No recent Script Block logs found."
}