Instructure Data Breach: Detecting ShinyHunters Exfiltration & LMS Defense

---
title: Potential Cloud Storage Exfiltration via CLI Tools
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential data exfiltration using command-line cloud tools often used by ShinyHunters (rclone, aws s3 sync) to download large datasets.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2025/04/17
tags:
  - attack.exfiltration
  - attack.t1048.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\aws.exe'
      - '\az.exe'
  selection_cli:
    CommandLine|contains:
      - 'sync'
      - 'copy'
      - 'download'
  condition: 1 of selection*
falsepositives:
  - Legitimate administrative backup tasks
level: high
---
title: PowerShell Web Request for Data Exfiltration
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell scripts making large outbound web requests or invoking specific methods used to exfiltrate data to external endpoints.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2025/04/17
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:\    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'Invoke-RestMethod'
      - 'IRM'
      - 'OutFile'
  filter_legit:
    CommandLine|contains:
      - 'SoftwareDistribution'
      - 'WindowsUpdate'
  condition: selection and not filter_legit
falsepositives:
  - System update mechanisms
  - Legitimate administrative scripts
level: medium

// Hunt for impossible travel or risky sign-ins associated with SaaS applications like Canvas
SigninLogs
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, RiskDetails, DeviceDetail
| extend Latitude = tostring(LocationDetails.geoCoordinates.latitude), Longitude = tostring(LocationDetails.geoCoordinates.longitude)
| evaluate geo_distance_cluster(IPAddress, Latitude, Longitude)
| where DistanceBetweenPointsInKilometers > 500 // Threshold for impossible travel
| summarize Count = count() by UserPrincipalName, IPAddress, AppDisplayName, bin(TimeGenerated, 1h)
| where Count > 3
| order by Count desc

-- Hunt for processes with active network connections to external IPs on non-standard ports
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name NOT IN ('svchost.exe', 'lsass.exe', 'explorer.exe', 'chrome.exe', 'firefox.exe', 'msedge.exe')

SELECT F.Pid, F.Name, F.CommandLine, N.RemoteAddress, N.RemotePort, N.State
FROM foreach(row={
    SELECT Pid
    FROM pslist()
    WHERE Name =~ 'powershell.exe' OR Name =~ 'cmd.exe' OR Name =~ 'wscript.exe'
}, query={
    SELECT Pid, Name, CommandLine, Exe, Username
    FROM pslist()
    WHERE Pid = _Pid
}) AS F
JOIN netstat() AS N
ON F.Pid = N.Pid
WHERE N.State =~ 'ESTABLISHED' AND N.RemotePort NOT IN (443, 80)

# Audit for Users Without MFA (Exchange Online / Azure AD Context)
# Requires Connect-MsolService or Connect-AzureAD

Write-Host "Checking for users without Strong Password Requirements or MFA enforcement..."

try {
    $Users = Get-MsolUser -All -ErrorAction Stop
    
    $WeakUsers = $Users | Where-Object {
        $_.StrongPasswordRequired -eq $false -or $_.StrongAuthenticationRequirements.Count -eq 0
    }
    
    if ($WeakUsers) {
        Write-Host "[ALERT] Found $($WeakUsers.Count) users vulnerable to credential stuffing." -ForegroundColor Red
        $WeakUsers | Select-Object UserPrincipalName, IsLicensed, StrongPasswordRequired | Export-Csv -Path "C:\Temp\VulnerableUsers_Instructure_Breach.csv" -NoTypeInformation
        Write-Host "Output saved to C:\Temp\VulnerableUsers_Instructure_Breach.csv"
    } else {
        Write-Host "[PASS] All users appear to have MFA requirements enabled." -ForegroundColor Green
    }
}
catch {
    Write-Error "Failed to connect to MS Online Services. Please ensure you are connected to a tenant."
    Write-Host "Run: Connect-MsolService"
}