ShinyHunters Arrest in Amsterdam: What Defenders Must Do Now to Stop SaaS Data Theft and Extortion

---
title: Commodity Exfiltration Tool Execution (Rclone / MEGA / Similar)
id: 3f8a1c42-9b2d-4e71-a6c3-7d5e9f0b2a14
status: experimental
description: Detects execution of rclone, megacmd, or similar cloud-sync exfiltration tools with copy/sync/move operations — a hallmark of data-theft extortion groups including ShinyHunters-associated actors.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://thehackernews.com/2026/09/dutch-police-arrest-24-year-old.html
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\mega-cmd.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - 'put'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate IT backup/sync workflows using rclone (baseline authorized usage per host and service account)
level: high
---
title: Bulk Database Export Utility Execution Outside Admin Context
id: 91c4d7a8-2e6f-4b39-c5d1-8a3e0f7b6c52
status: experimental
description: Detects execution of database dump/export utilities by non-database-admin accounts — consistent with staged bulk data extraction preceding extortion.
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.collection
  - attack.t1005
  - attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\mongoexport.exe'
  filter_known_dba_accounts:
    User|contains:
      - 'svc_sql'
      - 'svc_backup'
      - 'dba_'
  condition: selection and not filter_known_dba_accounts
falsepositives:
  - Scheduled maintenance scripts — tune the filter to your actual DBA service accounts
level: medium
---
title: OAuth Consent Grant to High-Risk Permissions (Entra ID)
id: 6b2e9d15-4a7c-4f88-b3e6-2c9d1a5f8e37
status: experimental
description: Detects admin or user consent grants to OAuth applications requesting broad data-access scopes — the persistence/access mechanism abused in SaaS token-theft campaigns such as the Salesforce/Salesloft Drift wave.
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1528
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add app role assignment to service principal'
      - 'Add OAuth2PermissionGrant'
    TargetResources|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'full_access_as_app'
      - 'offline_access'
      - 'Files.Read.All'
      - 'Sites.Read.All'
      - 'Directory.Read.All'
falsepositives:
  - Legitimate enterprise app onboarding — alert-tune by approved application IDs
level: high

// Hunt: ShinyHunters-style SaaS compromise pattern — anomalous sign-in followed by
// high-volume activity and/or new OAuth consent within a short window.
// Tables: SigninLogs + AuditLogs (Sentinel), DeviceProcessEvents (Defender)

let lookback = 14d;
let suspiciousSignins =
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| summarize
    SigninCount = count(),
    Locations = make_set(Location),
    IPs = make_set(IPAddress),
    Apps = make_set(AppDisplayName),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where SigninCount > 50 or array_length(Locations) > 2;
suspiciousSignins
| join kind=leftouter (
    AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName has_any ("Consent to application", "Add OAuth2PermissionGrant")
    | extend ConsentTarget = tostring(TargetResources[0].displayName)
    | summarize Consents = make_set(ConsentTarget) by Identity, bin(TimeGenerated, 1h)
) on $left.UserPrincipalName == $right.Identity, TimeGenerated
| project TimeGenerated, UserPrincipalName, SigninCount, Locations, IPs, Apps, Consents
| order by TimeGenerated desc;
// Follow-up: check the same users' endpoints for exfil tooling
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName has_any ("rclone.exe", "megacmd.exe", "mysqldump.exe", "pg_dump.exe", "mongoexport.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

-- Hunt for exfiltration and bulk-export tooling execution across the fleet
-- ShinyHunters-style data theft: rclone/MEGA exfil and DB dump utilities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(rclone|megacmd|mega-cmd|mysqldump|pg_dump|mongoexport|bcp)\.exe$'
   OR CommandLine =~ '(?i)(rclone (copy|sync|move)|megacmd .*put)'

# ShinyHunters-style SaaS compromise: Entra ID OAuth consent + endpoint exfil-tool audit
# Run as a Global Reader / Cloud App Security admin. Requires Microsoft.Graph module.

Import-Module Microsoft.Graph.Identity.DirectoryManagement -ErrorAction Stop
Connect-MgGraph -Scopes "Directory.Read.All","Application.Read.All","AuditLog.Read.All"

# 1) Find service principals holding high-risk delegated/application scopes
$riskyScopes = 'Mail.Read','Mail.ReadWrite','full_access_as_app','Files.Read.All','Sites.Read.All','Directory.Read.All','offline_access'
$spGrants = Get-MgOauth2PermissionGrant -All
foreach ($grant in $spGrants) {
    $granted = $grant.Scope -split ' '
    $hit = $granted | Where-Object { $riskyScopes -contains $_ }
    if ($hit) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId
        [PSCustomObject]@{
            AppName      = $sp.DisplayName
            AppId        = $sp.AppId
            CreatedDate  = $sp.AdditionalProperties.createdDateTime
            RiskyScopes  = ($hit -join ',')
            ConsentType  = $grant.ConsentType
        }
    }
} | Format-Table -AutoSize
# ACTION: For any app you cannot attribute to a documented business owner,
# revoke with: Revoke-MgOauth2PermissionGrant -OAuth2PermissionGrantId <Id>
# then remove: Remove-MgServicePrincipal -ServicePrincipalId <Id>

# 2) Enforce admin consent workflow (block user self-consent)
Update-MgPolicyAuthorizationPolicy -BodyParameter @{
    defaultUserRolePermissions = @{ permissionGrantPoliciesAssigned = @() }
}

# 3) Audit endpoints for exfil tooling footprints (run via your EDR/remote shell)
Get-ChildItem -Path 'C:\Users\*\AppData\Roaming\rclone','C:\ProgramData\MEGAcmd' -Recurse -ErrorAction SilentlyContinue |
    Select-Object FullName, LastWriteTime
Get-ChildItem 'C:\Users\*\AppData\Roaming\rclone\rclone.conf' -ErrorAction SilentlyContinue |
    ForEach-Object { Write-Warning "Rclone config found: $($_.FullName) — inspect remotes for unauthorized cloud destinations" }