RingCentral Breach by ShinyHunters: 1.6M Accounts Exposed — SaaS Exfiltration Detection and Response Guide

---
title: Suspicious OAuth Consent Grant to New or Unverified Application
id: 2c7f3a91-4d8e-4b1a-9f2e-6a0b5c8d3e71
status: experimental
description: Detects consent grants to OAuth applications, a technique used by extortion groups such as ShinyHunters to maintain API-level access to SaaS tenants (e.g., RingCentral, Salesforce) without needing credentials after initial compromise.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add delegated permission grant'
      - 'Add app role assignment to service principal'
  filter_known_good:
    InitiatedBy|contains:
      - 'known-admin-upn-prefix@yourdomain.com'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate application onboarding by IT
  - Developer teams registering internal integrations
level: high
---
title: Bulk Data Export via Scripting or API Client Tooling
id: 8e1d6c42-3b9f-4a7d-b5e1-2f4a7c9d6e83
status: experimental
description: Detects interactive or scripted use of HTTP/API client tooling commonly used to enumerate and bulk-export data from SaaS platforms such as RingCentral after credential or token theft. Attackers frequently pull records with curl, Python requests, or Postman from non-standard hosts.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1530
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\curl.exe'
      - '\python.exe'
      - '\pythonw.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'ringcentral.com'
      - 'api.ringcentral'
      - '/restapi/'
      - 'Invoke-RestMethod'
      - 'Invoke-WebRequest'
      - 'requests.get'
  condition: all of selection_*
falsepositives:
  - Legitimate RingCentral integrations run from approved automation hosts
  - DevOps pipelines (allowlist by host and service account)
level: medium
---
title: Cloud Resource Access From Data Center IP Space
id: 4f9a2e17-8c3b-4d5a-a1f6-7e8b9c0d2a45
status: experimental
description: Detects sign-ins to cloud/SaaS platforms originating from known hosting/data-center providers. Extortion actors operate from VPS and bulletproof hosting rather than residential or corporate egress, making ASN-based anomaly detection high-signal for SaaS account takeover.
references:
  - https://attack.mitre.org/techniques/T1078/004/
  - https://attack.mitre.org/techniques/T1090/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1078.004
  - attack.t1090.003
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 0
    NetworkLocationDetail|contains:
      - 'hosting'
      - 'datacenter'
      - 'data center'
falsepositives:
  - Corporate egress through cloud-hosted proxies or ZTNA providers
  - Automated service workloads (allowlist managed identities)
level: medium

// Hunt: Anomalous SaaS/API activity volume per identity — ShinyHunters-style bulk extraction
// Identifies users or service principals generating abnormal API/audit-event volume,
// plus sign-ins from unfamiliar ASNs, plus new OAuth consents in the same window.
let lookback = 14d;
let consent_events =
    AuditLogs
    | where TimeGenerated >= ago(lookback)
    | where OperationName in~ ("Consent to application", "Add service principal", "Add delegated permission grant")
    | mv-extend InitiatedBy = parse_json(tostring(InitiatedBy.user))
    | extend ConsentActor = tostring(InitiatedBy.userPrincipalName)
    | project ConsentTime = TimeGenerated, OperationName, ConsentActor,
              TargetApp = tostring(TargetResources[0].displayName),
              IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress);
let risky_signins =
    SigninLogs
    | where TimeGenerated >= ago(lookback)
    | where ResultType == 0
    | summarize SigninCount = count(), Apps = make_set(AppDisplayName, 10),
                Locations = make_set(LocationDetails, 5)
        by UserPrincipalName, IPAddress
    | where SigninCount > 50;
consent_events
| join kind=inner risky_signins on $left.ConsentActor == $right.UserPrincipalName
| project ConsentTime, ConsentActor, TargetApp, OperationName, ConsentIP = IPAddress, SigninCount, Apps
| order by ConsentTime desc;
// Complementary hunt: endpoints reaching UCaaS API endpoints from non-browser processes
DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemoteUrl has_any ("ringcentral.com", "platform.ringcentral", "api.ringcentral")
| where InitiatingProcessFileName !in~ ("msedge.exe", "chrome.exe", "firefox.exe", "RingCentral.exe")
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Connections desc;

-- Hunt for local artifacts of bulk SaaS data export:
-- large CSV/JSON exports in user download/temp paths and scripted HTTP clients
-- referencing RingCentral (or generic UCaaS API) endpoints.
LET export_files = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/Downloads/*.csv',
                 'C:/Users/*/Downloads/*.json',
                 'C:/Users/*/AppData/Local/Temp/*.csv'])
WHERE Size > 10485760
ORDER BY Mtime DESC

LET api_clients = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(?i)(ringcentral|/restapi/|invoke-restmethod|requests\.get|bearer )'

SELECT 'BulkExportFile' AS ArtifactType, FullPath AS Detail, format('%v', Size) AS Size, Mtime AS LastSeen, '' AS User, 0 AS Pid
FROM export_files
UNION ALL
SELECT 'APIClientProcess' AS ArtifactType, CommandLine AS Detail, '' AS Size, now() AS LastSeen, Username AS User, Pid
FROM api_clients

# RingCentral/SaaS breach readiness: audit OAuth consents and privileged grants in Entra ID
# Run as a Global Reader / Cloud App Security admin. Requires Microsoft Graph SDK.
# Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","AuditLog.Read.All" -NoWelcome

# 1) List all OAuth2 delegated permission grants (consents) granted in the last 90 days
$cutoff = (Get-Date).AddDays(-90)
$grants = Get-MgOauth2PermissionGrant -All | Where-Object {
    $_.CreatedDateTime -and [datetime]$_.CreatedDateTime -gt $cutoff
}

$report = foreach ($g in $grants) {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        ConsentType   = $g.ConsentType
        Scope         = $g.Scope
        AppName       = $sp.DisplayName
        AppId         = $sp.AppId
        Verified      = ($sp.VerifiedPublisher.DisplayName -ne $null)
        Created       = $g.CreatedDateTime
    }
}

# High-signal: AllPrincipals (tenant-wide admin consent) to unverified publishers
$report | Where-Object { $_.ConsentType -eq 'AllPrincipals' -and -not $_.Verified } |
    Format-Table -AutoSize
$report | Export-Csv -Path ".\OAuthConsentAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# 2) Find service principals with high-privilege Graph/API roles that could enable mass export
$highValueRoles = @('Mail.Read','Contacts.Read','User.Read.All','Directory.Read.All',
                    'CallRecords.Read.All','Reports.Read.All','Sites.FullControl.All')
foreach ($sp in (Get-MgServicePrincipal -All -Property "AppRoleAssignments,DisplayName")) {
    foreach ($ara in $sp.AppRoleAssignments) {
        $resSp = Get-MgServicePrincipal -ServicePrincipalId $ara.ResourceId -ErrorAction SilentlyContinue
        $roleName = ($resSp.AppRoles | Where-Object Id -eq $ara.AppRoleId).Value
        if ($roleName -in $highValueRoles) {
            [PSCustomObject]@{ ServicePrincipal = $sp.DisplayName; AppId = $sp.AppId; GrantedRole = $roleName }
        }
    }
} | Sort-Object GrantedRole -Unique | Format-Table -AutoSize

# 3) Remediation prompt: revoke consent for confirmed-suspicious apps
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <grantId>
# Remove-MgServicePrincipal -ServicePrincipalId <spId>   # full removal of rogue app