ShinyHunters Claims Florida DMV 'DAVID' Database Breach: Detection and Response Guide for Government Data Custodians

---
title: Browser Credential Store Access by Non-Browser Process
id: 3f8a1c92-7d4e-4b61-a9f3-2c5e8d01b4a7
status: experimental
description: Detects processes other than the browser itself reading browser credential or cookie stores, consistent with infostealer harvesting that precedes valid-account portal compromise (ShinyHunters initial-access TTP).
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
  - https://www.bleepingcomputer.com/news/security/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\logins.json'
      - '\key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\msedgewebview2.exe'
  condition: selection_paths and not filter_browsers
falsepositives:
  - EDR and DLP agents performing authorized file inspection
  - Enterprise password managers with browser integration
level: high
---
title: Mass Data Export Utility Execution on Database or Application Servers
id: 91b2e7d4-3c6a-4f58-b2e1-8d4c7a09f3e2
status: experimental
description: Detects execution of bulk-export or database client tooling (sqlcmd, bcp, mysqldump, pg_dump) writing output to files, a common method of staging PII before exfiltration from backend systems.
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1567/
  - https://www.bleepingcomputer.com/news/security/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1005
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\mongoexport.exe'
      - '\expdp.exe'
  selection_output:
    CommandLine|contains:
      - ' out '
      - ' -o '
      - 'queryout'
      - '>'
      - '--result-file'
      - '--file='
  condition: all of selection_*
falsepositives:
  - Scheduled DBA backup and ETL jobs — whitelist known service accounts and scheduled task contexts
level: high
---
title: Archive Staging of Exported Data in User-Writable Directories
id: 6c4d9f18-2a7b-4e35-9c84-5f1a3b6d8e02
status: experimental
description: Detects creation of large archive files in staging locations commonly used before exfiltration of stolen database records.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.bleepingcomputer.com/news/security/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: file_event
  product: windows
detection:
  selection_dirs:
    TargetFilename|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.tar.gz'
  filter_tools:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\TiWorker.exe'
      - '\msiexec.exe'
  condition: all of selection_* and not filter_tools
falsepositives:
  - Software packaging and deployment activity
  - Users archiving working files — tune by excluding known build/backup accounts
level: medium

// Hunt 1: Abnormal outbound data volume from application/database servers (bulk exfil signal)
// Requires web/proxy/firewall logs ingested via CEF into CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where isnotempty(SentBytes)
| summarize TotalSentMB = round(sum(todouble(SentBytes)) / 1048576.0, 1),
            SessionCount = count(),
            DistinctSources = dcount(SourceIP)
    by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where TotalSentMB > 200   // tune to your portal's legitimate per-hour baseline
| order by TotalSentMB desc
;

// Hunt 2: Authentication anomaly — repeated failures followed by success (credential stuffing / guessing against portal or VPN)
// Uses Syslog/CEF-ingested authentication logs from web SSO, VPN, or portal front ends
let FailWindow = 15m;
Syslog
| where TimeGenerated > ago(24h)
| where Facility =~ "auth" or SyslogMessage has_any ("authentication failure", "Failed password", "login failed")
| summarize FailCount = count() by SourceIP = coalesce(Computer, HostIP), bin(TimeGenerated, FailWindow)
| where FailCount >= 20
| join kind=inner (
    Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage has_any ("Accepted password", "authentication succeeded", "login successful")
    | project SuccessTime = TimeGenerated, SourceIP = coalesce(Computer, HostIP), SyslogMessage
) on SourceIP
| project SourceIP, FailCount, FailureWindowStart = TimeGenerated, SuccessTime, SyslogMessage
| order by FailCount desc
;

// Hunt 3: Endpoint processes making unusual external connections from server-class devices
// (export tooling or staging processes beaconing out)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("sqlcmd.exe", "bcp.exe", "mysqldump.exe", "pg_dump.exe", "7z.exe", "rar.exe", "curl.exe", "wget.exe")
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIPType == "Public"
) on DeviceId, ProcessId
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemoteUrl, InitiatingProcessAccountName
| order by TimeGenerated desc

-- Velociraptor hunt: staging artifacts and export tooling on servers/workstations with portal access
-- Looks for recent archives in staging paths AND running export/archiving processes
LET staging_archives = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/Public/*.zip',
  'C:/Users/Public/*.rar',
  'C:/Users/Public/*.7z',
  'C:/Windows/Temp/*.zip',
  'C:/Windows/Temp/*.7z',
  'C:/ProgramData/*.rar'
])
WHERE Size > 50000000  -- >50MB: filter routine noise

LET suspicious_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(sqlcmd|bcp|mysqldump|pg_dump|rar|7z|curl|wget)'
   OR CommandLine =~ '(?i)(queryout|--result-file|mysqldump|pg_dump)'

SELECT * FROM staging_archives
UNION ALL
SELECT FullPath=NULL, Size=NULL, Mtime=NULL, Pid=Pid, Name=Name,
       CommandLine=CommandLine, Username=Username, CreateTime=CreateTime
FROM suspicious_procs

#!/bin/bash
# audit_portal_access.sh — flag portal sessions with anomalous record-lookup volume
# Run against exported web/application access logs (combined or JSON-per-line format).
# Adjust LOGFILE, field positions, and THRESHOLD to your platform's log schema.

LOGFILE="/var/log/portal/access.log"
THRESHOLD=500          # record lookups per account per day — tune to legitimate baseline
REPORT="portal_bulk_query_report_$(date +%F).txt"

echo "=== Bulk Query Audit — $(date) ===" | tee "$REPORT"

echo -e "\n[+] Top accounts by query volume (last 24h):" | tee -a "$REPORT"
grep "$(date +%d/%b/%Y)" "$LOGFILE" \
  | awk '{print $3}' \
  | sort | uniq -c | sort -rn | head -25 | tee -a "$REPORT"

echo -e "\n[+] Accounts exceeding ${THRESHOLD} lookups today (POSSIBLE BULK SCRAPING):" | tee -a "$REPORT"
grep "$(date +%d/%b/%Y)" "$LOGFILE" \
  | awk '{print $3}' \
  | sort | uniq -c \
  | awk -v t="$THRESHOLD" '$1 > t {print $1" lookups — account: "$2}' | tee -a "$REPORT"

echo -e "\n[+] Single source IPs authenticating as MULTIPLE distinct accounts (shared/stolen creds):" | tee -a "$REPORT"
awk '{print $1, $3}' "$LOGFILE" \
  | sort -u | awk '{print $1}' \
  | sort | uniq -c | awk '$1 > 3 {print $1" accounts from IP: "$2}' | tee -a "$REPORT"

echo -e "\n[+] Off-hours query activity (00:00–05:00) by account:" | tee -a "$REPORT"
awk '$4 ~ /:0[0-5]:/ {print $3}' "$LOGFILE" \
  | sort | uniq -c | sort -rn | head -15 | tee -a "$REPORT"

echo -e "\nAudit complete. Investigate any account in the threshold or off-hours sections against its historical baseline."