ShinyHunters Crackdown: Defending SaaS and Cloud Platforms Against Vishing-Driven Data Extortion Campaigns

---
title: Suspicious OAuth Consent Grant to Uncommon Application
tid: 3f8a2c14-9b6e-4d71-a5c3-8e2f1a9b4d07
status: experimental
description: Detects user consent grants to OAuth applications, a primary ShinyHunters vector for persistent SaaS/M365 access via vishing-guided consent. Review newly consented apps for legitimacy, especially those with broad data scopes.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  category: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
      - 'Add service principal'
  filter_known_admins:
    InitiatedBy|contains:
      - 'tenant-admin'
  condition: selection_operation and not filter_known_admins
falsepositives:
  - Legitimate business application onboarding
  - IT-driven app deployments
level: high
---
title: PowerShell Data Loader or Bulk Export Tooling Execution on Workstations
tid: 7c1e9b52-4a3d-4f86-b2e1-5d8c3a7f9e04
status: experimental
description: Detects execution of bulk data export patterns and Salesforce Data Loader style CLI invocations from endpoints. ShinyHunters operators and their victims are guided to use data loader tooling; unexpected bulk export tooling on non-admin workstations warrants review.
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\dataloader.exe'
      - '\sfdx.exe'
      - '\data_loader.exe'
  selection_cli:
    CommandLine|contains:
      - 'bulk export'
      - 'queryAll'
      - '--sobject'
  condition: 1 of selection_*
falsepositives:
  - Salesforce administrators and developers performing legitimate exports
  - Scheduled ETL integrations
level: medium
---
title: OAuth Token Use From Anomalous ASN Against SaaS APIs
tid: 1a4d7e93-6c28-4b5f-9a31-2e7c5b8d3f60
status: experimental
description: Detects authentication/API access to Salesforce or M365 resources from hosting provider ASNs where user interactive logins are absent, consistent with attacker infrastructure replaying consented OAuth tokens.
references:
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.exfiltration
logsource:
  product: azure
  category: signinlogs
detection:
  selection:
    AppDisplayName|contains:
      - 'Salesforce'
      - 'Data Loader'
      - 'Connected App'
  filter_risk:
    RiskLevelDuringSignIn: 'none'
  condition: selection and not filter_risk
falsepositives:
  - Legitimate integration service accounts from cloud-hosted middleware
level: medium

// Hunt 1: New OAuth consent grants followed by anomalous sign-in behavior
// Correlate consent events with subsequent token use from unusual locations/ASNs.
let consentEvents = AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName in~ ("Consent to application", "Add OAuth2PermissionGrant")
| extend ConsentUser = tostring(parse_json(InitiatedBy).user.userPrincipalName)
| extend AppName = tostring(TargetResources[0].displayName)
| project ConsentTime=TimeGenerated, ConsentUser, AppName;
SigninLogs
| where TimeGenerated > ago(14d)
| where AppDisplayName has_any ("Salesforce", "Data Loader", "Connected")
| join kind=inner consentEvents on $left.UserPrincipalName == $right.ConsentUser
| summarize FirstSeen=min(TimeGenerated), Locations=make_set(Location), ASNs=make_set(NetworkLocationDetails), Apps=make_set(AppDisplayName) by UserPrincipalName, IPAddress
| where array_length(Locations) > 2
| sort by FirstSeen desc;

// Hunt 2: Salesforce bulk API export anomalies (requires Salesforce Event Monitoring ingestion)
// Flags users performing Bulk API / report exports at volume far above their 30-day baseline.
let baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(1d))
| where DeviceVendor =~ "Salesforce"
| where Activity has_any ("API", "ReportExport", "BulkAPI")
| summarize AvgOps=count() by SourceUserID;
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where DeviceVendor =~ "Salesforce"
| where Activity has_any ("API", "ReportExport", "BulkAPI", "DataExport")
| summarize RecentOps=count(), QueriedObjects=make_set(AdditionalExtensions) by SourceUserID, SourceIP
| join kind=leftouter baseline on SourceUserID
| where RecentOps > (AvgOps * 5) or isnull(AvgOps)
| project SourceUserID, SourceIP, RecentOps, AvgOps, QueriedObjects;

// Hunt 3: Endpoint — data loader tooling or browser token theft artifacts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("dataloader", "sfdx", "workbench")
   or ProcessCommandLine has_any ("bulk", "queryAll", "sobject", "export")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
| sort by TimeGenerated desc;

-- Hunt for bulk export staging files and Salesforce data loader artifacts on endpoints
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.csv',
  'C:/Users/*/Documents/**/export*.csv',
  'C:/Program Files*/**/dataloader*',
  'C:/Users/*/AppData/**/Data Loader*'
])
WHERE Mtime > timestamp(epoch=now() - 1209600)
  AND (FullPath =~ '(?i)dataloader'
       OR (FullPath =~ '(?i)\\.csv$' AND Size > 5000000))
ORDER BY Mtime DESC

-- Correlate with recent outbound connections to Salesforce API endpoints from non-browser processes
SELECT Pid, Name, Path, Address, Port, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name !~ '(?i)(chrome|msedge|firefox|brave)'

# Requires: Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","DelegatedPermissionGrant.Read.All"
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All" -NoWelcome

$lookbackDays = 30
$cutoff = (Get-Date).AddDays(-$lookbackDays)
$dangerousScopes = @("Mail.Read","Files.Read.All","Sites.Read.All","full_access","Contacts.Read","offline_access","User.Read.All","Reports.Read.All")

Write-Host "=== OAuth2 Permission Grants (Delegated Consent) ===" -ForegroundColor Cyan
$grants = Get-MgOauth2PermissionGrant -All
foreach ($g in $grants) {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
    $scopes = $g.Scope -split ' '
    $risky = $scopes | Where-Object { $_ -in $dangerousScopes }
    if ($risky) {
        [PSCustomObject]@{
            AppName    = $sp.DisplayName
            AppId      = $sp.AppId
            Created    = $sp.AdditionalProperties.createdDateTime
            ConsentType= $g.ConsentType
            RiskyScopes= ($risky -join ',')
            Publisher  = $sp.PublisherName
            Verified   = ($sp.VerifiedPublisher -ne $null)
        }
    }
}

Write-Host "`n=== App Role Assignments (Application Consent) ===" -ForegroundColor Cyan
Get-MgServicePrincipal -All | ForEach-Object {
    $sp = $_
    Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{
            AppName   = $sp.DisplayName
            AppId     = $sp.AppId
            RoleId    = $_.AppRoleId
            Created   = $_.CreatedDateTime
        }
    }
} | Where-Object { $_.Created -gt $cutoff }

# To revoke a confirmed malicious grant:
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <GrantId>
# To disable the malicious service principal:
# Update-MgServicePrincipal -ServicePrincipalId <Id> -AccountEnabled:$false