Manchester Airports Group Breach: 8.8M Records Leaked via Third-Party Database — Detection and Third-Party Risk Remediation Guide

---
title: Bulk Compression Staging of Data for Exfiltration
id: 9f2c1a74-3b8e-4d21-a6c7-5e8f9a0b1c2d
status: experimental
description: Detects creation of large compressed archives via common archiving utilities, a frequent precursor to mass data exfiltration as seen in third-party database breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' u '
  condition: selection_img and selection_cli
falsepositives:
  - Scheduled backup jobs using archivers
  - Software packaging by developers
level: medium
---
title: Rclone or Cloud Sync Tool Execution for Exfiltration
id: 4e7b2d93-1c5a-4f68-b9d2-7a1e3c5f8b09
status: experimental
description: Detects execution of cloud sync/exfiltration tools (rclone, MEGAcmd, etc.) commonly used to move bulk stolen data to attacker-controlled cloud storage, as in the MAG/FulcrumSec leak.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAcmd.exe'
      - '\mega-cmd.exe'
      - '\gdown.exe'
      - '\aws.exe'
  condition: selection
falsepositives:
  - Sanctioned cloud backup agents (whitelist known service accounts/hosts)
level: high
---
title: Database Server Process Spawning Shell or Export Utility
id: 6d1a8e42-9f37-4b54-c2e8-3d6b0a9f4e17
status: experimental
description: Detects database service processes spawning shells or command-line export utilities, indicative of interactive attacker access and bulk data dump activity.
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\sqlservr.exe'
      - '\mysqld.exe'
      - '\postgres.exe'
      - '\mongod.exe'
      - '\oracle.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\mongoexport.exe'
  condition: selection_parent and selection_child
falsepositives:
  - DBA maintenance scripts and ETL jobs (tune by service account and host)
level: high

// Hunt 1: Anomalous high-volume outbound transfers from database/application servers
// Baseline against your environment; threshold tuned to flag bulk exfil of large datasets
let lookback = 14d;
let short_window = 1d;
let baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(lookback) .. ago(short_window))
| where DeviceName has_any ("sql", "db", "mysql", "postgres", "mongo")
| summarize AvgDailyBytes = avg(tolong(1)) by DeviceName; // placeholder for volume-enriched sources
DeviceNetworkEvents
| where TimeGenerated > ago(short_window)
| where RemoteIPType == "Public"
| where DeviceName has_any ("sql", "db", "mysql", "postgres", "mongo")
| summarize Connections = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName
| where DistinctDestinations <= 3 and Connections > 500
| sort by Connections desc;

// Hunt 2: Cloud storage / file-sharing destinations contacted by servers (exfil staging)
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("mega.nz", "mega.co.nz", "anonfiles", "gofile.io", "transfer.sh",
                           "file.io", "wetransfer.com", "temp.sh", "bashupload", "rclone")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteUrl, RemoteIP, RemotePort
| sort by TimeGenerated desc;

// Hunt 3: Mass data export tooling execution (Defender process telemetry)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rclone.exe", "mysqldump.exe", "pg_dump.exe", "mongoexport.exe", "bcp.exe")
   or ProcessCommandLine has_any ("SELECT *", "pg_dump", "mysqldump", "mongoexport", "rclone copy", "rclone sync")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated desc;

-- Hunt endpoints and servers for exfiltration staging artifacts:
-- recently created large archives and known exfil/sync tool binaries
LET archives = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/**.zip', 'C:/Users/*/**.7z', 'C:/Users/*/**.rar',
                 'C:/Temp/**.zip', 'C:/Temp/**.7z',
                 'C:/ProgramData/**.zip', 'C:/ProgramData/**.7z'])
WHERE Size > 104857600  -- >100MB archives
  AND Mtime > timestamp(epoch=now() - 604800)  -- created in last 7 days

LET tools = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/Downloads/rclone*.exe', 'C:/Users/*/**/rclone.exe',
                 'C:/ProgramData/**/rclone.exe', 'C:/Temp/**/rclone.exe',
                 'C:/Users/*/Downloads/MEGAcmd*.exe'])

SELECT 'LargeArchive' AS ArtifactType, FullPath, Size, Mtime FROM archives
UNION ALL
SELECT 'ExfilTool' AS ArtifactType, FullPath, Size, Mtime FROM tools

# MAG-Style Third-Party Database Breach: Exposure & Exfil Audit
# Run elevated on database/application servers. Read-only audit; no changes made.

Write-Host "=== [1] Database services listening on non-loopback interfaces ===" -ForegroundColor Cyan
$dbPorts = @(1433, 3306, 5432, 27017, 1521, 6379, 9200)
foreach ($port in $dbPorts) {
    $listeners = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue |
                 Where-Object { $_.LocalAddress -notin @('127.0.0.1','::1') }
    if ($listeners) {
        $listeners | ForEach-Object {
            Write-Warning "EXPOSED: Port $port listening on $($_.LocalAddress) — verify firewall segmentation"
        }
    }
}

Write-Host "`n=== [2] Exfiltration/sync tooling present on this host ===" -ForegroundColor Cyan
$toolPaths = @("$env:ProgramData", "$env:SystemDrive\Users", "$env:SystemDrive\Temp")
$tools = @('rclone.exe','MEGAcmd.exe','mega-cmd.exe','gdown.exe','winscp.exe','filezilla.exe')
foreach ($base in $toolPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Include $tools -ErrorAction SilentlyContinue |
          Select-Object -First 25 |
          ForEach-Object { Write-Warning "FOUND: $($_.FullName) — investigate legitimacy" }
    }
}

Write-Host "`n=== [3] Firewall rules permitting database ports from broad scopes ===" -ForegroundColor Cyan
Get-NetFirewallRule -Enabled True -Direction Inbound -ErrorAction SilentlyContinue |
  Where-Object { $_.Profile -match 'Public|Any' } |
  ForEach-Object {
      $rule = $_
      $ports = ($_ | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue).LocalPort
      if ($ports | Where-Object { $_ -in $dbPorts }) {
          Write-Warning "REVIEW: Rule '$($rule.DisplayName)' allows inbound DB port(s) on Public/Any profile"
      }
  }

Write-Host "`n=== [4] Audit policy for sensitive object access ===" -ForegroundColor Cyan
$audit = auditpol /get /subcategory:"File System" 2>$null
if ($audit -notmatch 'Success and Failure') {
    Write-Warning "File System auditing not fully enabled — bulk data access may go unlogged"
}

Write-Host "`nAudit complete. Remediate exposures, then repeat on all systems hosting customer data." -ForegroundColor Green