ShinyHunters Arrest After FBI Breach: Defending Against SaaS Data Theft and Extortion Campaigns

---
title: Suspicious OAuth Application Consent Grant
id: 3f8c1a72-5b9d-4e6a-b712-8d4f2c9a1e5b
status: experimental
description: Detects new OAuth consent grants to applications, a common persistence and access mechanism in SaaS data-theft campaigns where attackers register or consent malicious apps to maintain API access.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1098/003/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.persistence
  - attack.t1098.003
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
      - 'Add service principal'
  filter_known_admin:
    initiatedBy|contains:
      - 'admin@'
      - 'onmicrosoft.com'
  condition: selection and not filter_known_admin
falsepositives:
  - Legitimate application onboarding by business users; maintain an allowlist of approved app IDs
level: high
---
title: Impossible Travel or Anomalous SSO Sign-In
title_note: High-fidelity only when tuned
id: 9d2e4b61-7c3f-4a8d-9e21-5f6a3b8c2d47
status: experimental
description: Detects sign-in events flagged as anomalous by Azure AD Identity Protection, consistent with credential phishing and MFA token theft used in extortion-driven intrusions.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    riskLevelAggregated:
      - 'high'
      - 'medium'
    status.errorCode: 0
falsepositives:
  - VPN exit nodes and traveling executives; correlate with riskDetail and device state before escalation
level: medium
---
title: Bulk Data Export Tool Execution on Endpoint
id: 6b1f9c38-2d4a-4e7b-a593-1c8e7d5a3f26
status: experimental
description: Detects execution of cloud synchronization and exfiltration tooling (rclone, megacmd, aws/az CLI copy operations) frequently used to stage and move stolen SaaS data to attacker-controlled storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAcmd.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--transfers'
  condition: selection_img or selection_cli
falsepositives:
  - IT-managed backup workflows using rclone; baseline and allowlist known service accounts and paths
level: high

// Hunt: anomalous OAuth consent + high-risk sign-in + large SaaS data export patterns
// Tables: AuditLog, SigninLogs (Sentinel), DeviceProcessEvents (Defender)

// 1) New OAuth consent grants by non-admin users in the last 14 days
AuditLog
| where TimeGenerated > ago(14d)
| where OperationName in~ ("Consent to application", "Add OAuth2PermissionGrant", "Add service principal")
| extend InitiatedBy = tostring(parse_json(InitiatedBy).user.userPrincipalName)
| extend AppId = tostring(TargetResources[0].id)
| extend NewPermissions = tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[0].newValue)
| where NewPermissions has_any ("Mail.Read", "Files.Read", "Sites.Read.All", "full_access", "offline_access")
    or OperationName has "service principal"
| project TimeGenerated, OperationName, InitiatedBy, AppId, NewPermissions, Result
| order by TimeGenerated desc;

// 2) Risky sign-ins that succeeded — potential token/MFA theft
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where RiskLevelDuringSignIn in ("high", "medium") or RiskLevelAggregated in ("high", "medium")
| summarize SignIns = count(), Locations = make_set(Location), Apps = make_set(AppDisplayName)
    by UserPrincipalName, IPAddress, RiskDetail, bin(TimeGenerated, 1h)
| order by SignIns desc;

// 3) Endpoint exfiltration tooling
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "MEGAcmd.exe")
   or ProcessCommandLine has_any ("rclone copy", "rclone sync", "rclone move")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
| order by TimeGenerated desc

-- Hunt for bulk exfiltration tooling and staged archives on endpoints
-- Relevant when investigating suspected SaaS data theft with endpoint egress
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)rclone|megacmd|7z|winrar'
   OR CommandLine =~ '(?i)rclone (copy|sync|move)|--transfers|mega-'

-- Also review large recently-created archives in user profiles
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/**/*.zip')
WHERE Size > 50000000
  AND Mtime > now() - 604800

# Audit risky OAuth app consents in Entra ID (Microsoft Graph PowerShell)
# Run as a Global Reader / Security Admin after: Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All" -NoWelcome

# Enumerate all delegated permission grants and flag high-risk scopes
$highRiskScopes = 'Mail.Read','Mail.ReadWrite','Files.Read.All','Files.ReadWrite.All',
                  'Sites.Read.All','full_access_as_app','offline_access','Directory.Read.All'

$grants = Get-MgOauth2PermissionGrant -All
$report = foreach ($grant in $grants) {
    $scopes = $grant.Scope -split ' '
    $matched = $scopes | Where-Object { $highRiskScopes -contains $_ }
    if ($matched) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            AppDisplayName = $sp.DisplayName
            AppId          = $sp.AppId
            Publisher      = $sp.PublisherName
            Created        = $sp.AdditionalProperties.createdDateTime
            RiskyScopes    = ($matched -join '; ')
            ConsentType    = $grant.ConsentType
        }
    }
}
$report | Format-Table -AutoSize
$report | Export-Csv -Path '.\oauth_risk_audit.csv' -NoTypeInformation

# List unverified / external publisher apps consented in the tenant
Get-MgServicePrincipal -All | Where-Object {
    $_.VerifiedPublisher.verifiedPublisherId -eq $null -and
    $_.ServicePrincipalType -eq 'Application' -and
    $_.AppOwnerOrganizationId -ne (Get-MgOrganization).Id
} | Select-Object DisplayName, AppId, PublisherName |
    Export-Csv -Path '.\unverified_apps.csv' -NoTypeInformation

Write-Host "Review oauth_risk_audit.csv and unverified_apps.csv. Revoke suspicious grants via Entra portal or Remove-MgOauth2PermissionGrant."