ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Flaw — Detection and Hardening Guide

---
title: PeopleSoft WebLogic Java Process Spawning Shell
tid: 8f1c4a72-3b9e-4d21-a6f5-2c7e9b1d4a08
status: experimental
description: Detects cmd.exe, powershell.exe, or shell interpreters spawned by the WebLogic Java process hosting Oracle PeopleSoft PIA — a strong indicator of post-exploitation following web-tier compromise, consistent with the ShinyHunters PeopleSoft intrusion pattern.
references:
  - https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  filter_legit:
    CommandLine|contains:
      - 'Oracle\Middleware'
      - 'opmnctl'
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Rare — some Oracle administrative scripts invoke shells from Java management agents; baseline your environment first
level: high
---
title: JSP Web Shell Written to WebLogic PeopleSoft Deployment Directory
tid: 3e7a91c4-6d28-4f52-b8e1-9a5c2f7d3b16
status: experimental
description: Detects creation or modification of JSP files in WebLogic PeopleSoft deployment and autodeploy directories by non-deployment processes — indicative of web shell planting for persistence after web-tier exploitation.
references:
  - https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\user_projects\domains\'
      - '\applications\peoplesoft\'
      - '\PORTAL\'
      - '\autodeploy\'
      - '\PIA\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.ear'
  filter_deploy:
    Image|endswith:
      - '\java.exe'
      - '\wlsdeploy.exe'
  condition: selection_path and selection_ext and not filter_deploy
falsepositives:
  - Legitimate application deployments or PeopleTools patching windows — correlate with change records
level: high
---
title: Suspicious Outbound Connection from PeopleSoft Web Tier
tid: 5b2d8f16-4c93-4a77-e1d9-7f3a6c2e5b41
status: experimental
description: Detects the WebLogic Java process hosting PeopleSoft establishing outbound connections to uncommon external hosts or non-standard ports — consistent with data exfiltration or C2 following web application compromise.
references:
  - https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
    Initiated: 'true'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  filter_known_ports:
    DestinationPort:
      - 443
      - 80
      - 1521
      - 1522
  condition: selection and not filter_internal and not filter_known_ports
falsepositives:
  - Oracle outbound licensing/telemetry calls and legitimate SaaS integrations — allowlist known Oracle destinations after baselining
level: medium

// Hunt: PeopleSoft/WebLogic post-exploitation behavior across endpoints and network logs
// Deploy in Microsoft Sentinel or Defender. Covers shell spawns from Java,
// suspicious file writes, and anomalous outbound connections from PeopleSoft servers.

let PeopleSoftHosts = dynamic(["psft-app", "psft-web", "peoplesoft", "pia"]);

// 1. Java (WebLogic) spawning shells or recon tools
let ShellSpawns = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "java", "wls")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "certutil.exe", "whoami.exe", "net.exe", "curl.exe", "wget.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId;

// 2. Suspicious file writes into WebLogic/PeopleSoft deployment paths
let WebShellWrites = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("user_projects\\domains", "autodeploy", "PORTAL", "peoplesoft", "PIA")
| where FileName endswith_cs ".jsp" or FileName endswith_cs ".war"
| where ActionType == "FileCreated" or ActionType == "FileModified"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;

// 3. Outbound connections from PeopleSoft hosts to rare external destinations
let RareOutbound = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where DeviceName has_any (PeopleSoftHosts)
| where RemoteIPType == "Public"
| where RemotePort !in (443, 80, 1521, 1522)
| summarize ConnectionCount = count(), Ports = make_set(RemotePort) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
| where ConnectionCount < 50;

ShellSpawns
| union WebShellWrites
| union RareOutbound
| order by TimeGenerated desc

-- Velociraptor hunt: triage PeopleSoft servers for web shells and anomalous Java activity
-- Targets recently modified JSP/WAR artifacts in WebLogic deployment trees,
-- plus shell processes parented to Java and unexpected listening services.

-- Artifact 1: Recently modified JSP/WAR files in WebLogic/PeopleSoft paths
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs=['C:/Oracle/Middleware/user_projects/domains/**/*.jsp',
                 'C:/Oracle/Middleware/user_projects/domains/**/*.war',
                 '/u01/app/oracle/Middleware/user_projects/domains/**/*.jsp',
                 '/u01/app/oracle/Middleware/user_projects/domains/**/*.war',
                 '/**/peoplesoft/**/webserv/**/*.jsp'])
WHERE Mtime > (timestamp(epoch=now() - 1209600))
ORDER BY Mtime DESC

-- Artifact 2: Java processes with shell children or suspicious command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|bash|sh|certutil|curl|wget|nc|ncat)'
  AND CommandLine =~ '(?i)(whoami|invoke-|downloadstring|base64|/tmp/|chmod \+x)'

-- Artifact 3: Unexpected listening services on PeopleSoft hosts
SELECT Pid, Name, Family, Type, Laddr, Lport, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND Lport NOT IN (80, 443, 1521, 1522, 7001, 7002, 8000, 8001, 22, 3389, 5985)
ORDER BY Lport

#!/bin/bash
# peoplesoft-triage.sh — Rapid exposure and compromise triage for Oracle PeopleSoft/WebLogic hosts
# Run as root or the WebLogic service account. Read-only; safe for production.

set -u
REPORT="/tmp/psft_triage_$(date +%Y%m%d_%H%M%S).txt"
WL_HOME="${WL_HOME:-/u01/app/oracle/Middleware}"
DOMAIN_HOME="${DOMAIN_HOME:-$WL_HOME/user_projects/domains}"

echo "=== PeopleSoft/WebLogic Security Triage — $(date) ===" | tee "$REPORT"

# 1. Check WebLogic patch level (Smart Update / OPatch inventory)
echo -e "\n[1] Installed WebLogic patches (verify latest Oracle CPU is applied):" | tee -a "$REPORT"
if [ -x "$WL_HOME/utils/bsu/bsu.sh" ]; then
  "$WL_HOME/utils/bsu/bsu.sh" -view -status=applied -prod_dir="$WL_HOME/wlserver" 2>/dev/null | tee -a "$REPORT"
elif [ -x "$WL_HOME/OPatch/opatch" ]; then
  "$WL_HOME/OPatch/opatch" lsinventory 2>/dev/null | grep -iE "patch|applied" | head -40 | tee -a "$REPORT"
else
  echo "  [!] No patch utility found — verify WebLogic version manually against latest Oracle CPU." | tee -a "$REPORT"
fi

# 2. Find recently modified JSP/WAR/EAR artifacts (potential web shells)
echo -e "\n[2] JSP/WAR/EAR files modified in the last 30 days under domain home:" | tee -a "$REPORT"
find "$DOMAIN_HOME" -type f \( -name "*.jsp" -o -name "*.war" -o -name "*.ear" \) -mtime -30 -printf "%TY-%Tm-%Td %TH:%TM  %p\n" 2>/dev/null | sort -r | tee -a "$REPORT"

# 3. Look for shells spawned by WebLogic Java processes
echo -e "\n[3] Shell processes parented to Java (post-exploitation indicator):" | tee -a "$REPORT"
ps -eo pid,ppid,comm,args --forest | grep -iE "(bash|sh|nc|ncat|python|perl|curl|wget)" | grep -iE "java" | tee -a "$REPORT" || echo "  None found." | tee -a "$REPORT"

# 4. Flag internet-facing PeopleSoft PIA listeners
echo -e "\n[4] Listening services — confirm PIA is NOT bound to a public interface:" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -iE "java|http" | tee -a "$REPORT"
echo "  ACTION: If any listener above is reachable from the internet without a WAF/VPN gate, restrict immediately." | tee -a "$REPORT"

# 5. Recent Integration Broker / servlet access anomalies (large responses = possible bulk data theft)
LOG_DIR=$(find "$DOMAIN_HOME" -type d -name "servers" 2>/dev/null | head -1)
echo -e "\n[5] Top response sizes from PIA access logs (bulk extraction indicator):" | tee -a "$REPORT"
find "$LOG_DIR" -name "access.log*" -mtime -7 2>/dev/null -exec awk '{print $NF, $7}' {} \; 2>/dev/null | sort -rn | head -20 | tee -a "$REPORT"
echo "  ACTION: Investigate any single response >10MB to PeopleSoft query/report endpoints." | tee -a "$REPORT"

# 6. Failed authentication spikes against PeopleSoft
echo -e "\n[6] Failed PeopleSoft logons in last 24h (credential attack indicator):" | tee -a "$REPORT"
grep -riE "signon|failed" /tmp 2>/dev/null | head -0
grep -hiE "PSFT.*(fail|invalid|denied)" "$DOMAIN_HOME"/*/servers/*/logs/*.log 2>/dev/null | grep "$(date +%Y-%m-%d)" | wc -l | tee -a "$REPORT"

echo -e "\n=== Triage complete. Review $REPORT and escalate anomalies to your IR team. ==="