ShinyHunters Claims 284M Record Theft from McKesson — Healthcare Defenders' Detection and Response Playbook

---
title: Bulk Database Export Utility Execution on Non-Approved Host
id: 4e7a2c91-3b58-4f6d-9a21-8c1d5e6f7a2b
status: experimental
description: Detects execution of bulk data export/database client utilities (bcp, sqlcmd, mysqldump, pg_dump) on systems outside approved database administration hosts, consistent with mass data theft tradecraft used by extortion groups such as ShinyHunters.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1530
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\bcp.exe'
      - '\sqlcmd.exe'
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\mysqlpump.exe'
  selection_args:
    CommandLine|contains:
      - 'queryout'
      - ' out '
      - '--all-databases'
      - '--tab='
      - '-f '
  condition: selection_tools and selection_args
falsepositives:
  - Scheduled ETL and backup jobs on approved database administration hosts (whitelist by host and service account)
  - Legitimate DBA activity during maintenance windows
level: high
---
title: Archive Staging of Database Export Files
id: 8b3d5f12-7c49-4a1e-b6d3-2f9a4c8e1d57
status: experimental
description: Detects creation of large compressed archives from directories or file types commonly used for database exports (CSV, SQL dumps, TSV), indicating staging of stolen data prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
  selection_cli:
    CommandLine|contains:
      - '.csv'
      - '.sql'
      - '.tsv'
      - '.dump'
      - 'export'
      - 'backup'
  condition: selection and selection_cli
falsepositives:
  - Legitimate backup and archival operations by IT staff (whitelist approved accounts and paths)
level: medium
---
title: Suspicious MFA Device Enrollment or Password Reset Following Help Desk Interaction
id: 2f6c9a84-1d37-4e5b-a9f2-6b8d3e4c5f19
status: experimental
description: Detects rapid sequence of account password reset followed by new MFA factor enrollment, a pattern consistent with voice-phishing (vishing) attacks against help desks used by extortion groups for initial access.
references:
  - https://attack.mitre.org/techniques/T1656/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.initial_access
  - attack.t1656
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection_reset:
    OperationName|contains:
      - 'Reset password'
      - 'Change password (self-service)'
  selection_mfa:
    OperationName|contains:
      - 'Add registered device'
      - 'Register security info'
      - 'Add authentication method'
  condition: selection_reset or selection_mfa
falsepositives:
  - Legitimate self-service password resets and MFA enrollment (correlate per-user within short time windows and alert only on reset+enrollment sequences within 30 minutes)
level: high

// Hunt 1: Massive outbound data transfer from database or application servers
// Identifies hosts sending unusually large volumes externally in 24h windows
let threshold_gb = 50;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIPType == "Public"
| extend TotalMB = round(BytesSent / 1048576.0, 2)
| summarize TotalBytesSent = sum(BytesSent), Destinations = dcount(RemoteIP), 
    TopDestinations = make_set(RemoteUrl, 10) by DeviceName, bin(TimeGenerated, 1d)
| where TotalBytesSent > (threshold_gb * 1073741824)
| project TimeGenerated, DeviceName, TotalSentGB = round(TotalBytesSent / 1073741824.0, 2), Destinations, TopDestinations
| sort by TotalSentGB desc;

// Hunt 2: Password reset followed by MFA method change within 30 minutes (vishing pattern)
let lookback = 7d;
let resets = AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ("Reset password (by admin)", "Reset password (self-service)")
| extend UserPrincipal = tostring(TargetResources[0].userPrincipalName)
| project ResetTime = TimeGenerated, UserPrincipal, ResetInitiator = tostring(InitiatedBy.user.userPrincipalName);
let mfachanges = AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ("Add registered device", "User registered security info", "Add strong authentication phone app")
| extend UserPrincipal = tostring(TargetResources[0].userPrincipalName)
| project MFATime = TimeGenerated, UserPrincipal, MFAMethod = tostring(TargetResources[0].modifiedProperties[0].newValue);
resets
| join kind=inner mfachanges on UserPrincipal
| extend DeltaMinutes = datetime_diff('minute', MFATime, ResetTime)
| where DeltaMinutes between (0 .. 30)
| project UserPrincipal, ResetTime, ResetInitiator, MFATime, DeltaMinutes
| sort by ResetTime desc;

// Hunt 3: Bulk export tooling execution across the fleet (Defender process telemetry)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("bcp.exe", "sqlcmd.exe", "mysqldump.exe", "pg_dump.exe")
    or ProcessCommandLine has_any ("queryout", "--all-databases", "--tab=")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated desc;

-- Hunt for bulk data staging artifacts and export utility execution
-- Deploy across servers hosting PHI databases and adjacent application tiers

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(queryout|--all-databases|--tab=|pg_dump|mysqldump)'
   OR Exe =~ '(?i)(bcp|sqlcmd|mysqldump|pg_dump)\.exe$'

-- Also hunt staged export files in suspicious locations
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Temp/**/*.zip',
    'C:/Users/*/AppData/Local/Temp/**/*.7z',
    'C:/Users/*/AppData/Local/Temp/**/*.csv',
    'C:/Users/*/Downloads/**/*.sql',
    'C:/ProgramData/**/*.dump'
])
WHERE Size > 104857600
  AND Mtime > (now() - 604800)
ORDER BY Size DESC

# McKesson/ShinyHunters-Style Threat: Data Exfiltration Exposure Assessment
# Run elevated on database/application servers. Review output before making changes.

$report = @()

# 1. Check for presence of bulk export tools on systems that should not have them
$exportTools = @('bcp.exe','sqlcmd.exe','mysqldump.exe','pg_dump.exe','mysqlpump.exe')
$foundTools = @()
foreach ($path in @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", 'C:\Tools', 'C:\Utils')) {
    if (Test-Path $path) {
        foreach ($tool in $exportTools) {
            $found = Get-ChildItem -Path $path -Filter $tool -Recurse -ErrorAction SilentlyContinue | Select-Object -First 3
            if ($found) { $foundTools += $found.FullName }
        }
    }
}
$report += "[EXPORT TOOLS PRESENT] $($foundTools -join '; ')"

# 2. Audit recent large file creation in temp/download paths (staging artifacts)
$stagingPaths = @("$env:TEMP", 'C:\ProgramData', 'C:\Users\Public')
foreach ($sp in $stagingPaths) {
    if (Test-Path $sp) {
        $large = Get-ChildItem -Path $sp -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -gt 100MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and
                           $_.Extension -match '\.(zip|7z|rar|csv|sql|tsv|dump)$' } |
            Select-Object FullName, Length, LastWriteTime
        foreach ($f in $large) { $report += "[STAGING ARTIFACT] $($f.FullName) - $([math]::Round($f.Length/1MB))MB - $($f.LastWriteTime)" }
    }
}

# 3. Verify WDAC/AppLocker policy is in place restricting export utilities
$applocker = Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue
if ($null -eq $applocker) {
    $report += "[GAP] No effective AppLocker policy found - export utilities cannot be restricted. Deploy WDAC or AppLocker rules blocking bcp.exe/sqlcmd.exe outside approved DBA groups."
} else {
    $report += "[OK] AppLocker policy present - verify executable rules cover database client tools."
}

# 4. Check audit policy for sensitive process and file access auditing
$audit = auditpol /get /subcategory:"Process Creation" 2>$null
if ($audit -notmatch 'Success and Failure|Success') {
    $report += "[GAP] Process Creation auditing not fully enabled - run: auditpol /set /subcategory:'Process Creation' /success:enable"
} else { $report += "[OK] Process Creation auditing enabled." }

$cmdAudit = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
if ($cmdAudit -ne 1) {
    $report += "[GAP] Command-line auditing disabled - set HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = 1"
} else { $report += "[OK] Command-line auditing enabled." }

# 5. Verify LAPS is deployed (local admin credential hygiene)
$laps = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -ErrorAction SilentlyContinue
if ($null -eq $laps) {
    $report += "[GAP] Legacy LAPS policy not detected - verify Windows LAPS (2023+) or legacy LAPS deployment for local admin rotation."
} else { $report += "[OK] LAPS policy registry keys present." }

$report | Out-File "$env:USERPROFILE\Desktop\exfil_exposure_assessment.txt" -Encoding utf8
Write-Host "Assessment complete. Results written to Desktop\exfil_exposure_assessment.txt"
$report