SHINYHUNTERS Extortion Campaign: 4 New Victims Posted — Tech, Healthcare & Financial Sector Analysis with Detection Rules

---
title: Office Application Spawning Script Interpreter - Phishing Initial Access
id: 8f3d2b1a-4c5e-4a6b-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects Microsoft Office applications spawning command shells or script interpreters, consistent with spear-phishing macro execution used for initial access by extortion groups including SHINYHUNTERS.
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate add-ins or mail-merge automation
level: high
---
title: PsExec-Style Remote Service Installation - Lateral Movement
id: 9a4e3c2b-5d6f-4b7c-8d9e-2f3a4b5c6d7e
status: experimental
description: Detects installation of remote execution services (PsExec and clones) via the Service Control Manager, a common lateral movement technique during ransomware staging.
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
tags:
    - attack.lateral_movement
    - attack.t1569.002
    - attack.t1021.002
logsource:
    product: windows
    service: system
detection:
    selection_event:
        EventID: 7045
    selection_svc:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'paexec'
            - 'remcom'
    selection_path:
        ImagePath|contains:
            - 'ADMIN$'
            - '\\127.0.0.1'
            - '%SystemRoot%\\PSEXESVC.exe'
    condition: selection_event and (selection_svc or selection_path)
falsepositives:
    - Legitimate administrative use of PsExec by IT (tune per environment)
level: high
---
title: Volume Shadow Copy Deletion - Pre-Encryption Backup Tampering
id: 1b5f4d3c-6e7a-4c8d-9e0f-3a4b5c6d7e8f
status: experimental
description: Detects deletion or tampering of Volume Shadow Copies and backup catalog, a near-universal pre-encryption step in ransomware and extortion playbooks.
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    selection_wmic:
        Image|endswith:
            - '\wmic.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - 'shadowcopy delete'
            - 'Win32_ShadowCopy'
    selection_bcd:
        Image|endswith:
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_wbadmin:
        Image|endswith:
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
    condition: 1 of selection_*
falsepositives:
    - Storage administrators resizing shadowstorage during maintenance windows
level: critical

// Security Arsenal Threat Hunt — Pre-Ransomware Staging & Lateral Movement (SHINYHUNTERS TTP set)
// Hunts: unauthorized RMM tooling, mass compression (exfil staging), suspicious admin-share activity
// Data sources: DeviceProcessEvents, DeviceNetworkEvents (Microsoft Sentinel / Defender XDR)
let lookback = 7d;
let RMM_Tools = dynamic(["screenconnect", "anydesk", "teamviewer", "splashtop", "atera", "ninjarmm", "rustdesk"]);
let Compression_Tools = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe"]);
let rmm =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (RMM_Tools) or ProcessCommandLine has_any (RMM_Tools)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName
    | extend Signal = "Unauthorized RMM Execution";
let staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (Compression_Tools)
    | where ProcessCommandLine has_any ("a -", "-p", ".zip", ".rar", ".7z") // archive creation, often password-protected
    | where InitiatingProcessAccountName !in~ ("system", "network service")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName
    | extend Signal = "Mass Archive Creation (Exfil Staging)";
let adminshare =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemotePort == 445 and ActionType == "ConnectionSuccess"
    | where InitiatingProcessFileName in~ ("psexesvc.exe", "psexec.exe", "wmiprvse.exe", "rundll32.exe")
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessAccountName
    | extend Signal = "SMB Lateral Movement (PsExec/WMI)";
union rmm, staging, adminshare
| sort by TimeGenerated desc
| summarize Signals = make_set(Signal), Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessAccountName
| extend Score = array_length(Signals) * 33
| order by Score desc

# Security Arsenal Rapid Triage Script — SHINYHUNTERS Campaign Response
# Run elevated on suspected hosts. Checks: RDP exposure, recent scheduled tasks,
# shadow copy integrity, unauthorized RMM presence.
# Author: Security Arsenal Threat Intelligence — 2026-08-23

$report = @()
$cutoff = (Get-Date).AddDays(-7)

# 1. Check RDP exposure and NLA enforcement
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report += [pscustomobject]@{Check='RDP Enabled (0=Yes)'; Value=$rdpEnabled; Risk=if($rdpEnabled -eq 0){'HIGH'}else{'OK'}}
$report += [pscustomobject]@{Check='NLA Enforced (1=Yes)'; Value=$nla; Risk=if($nla -ne 1){'HIGH'}else{'OK'}}

# 2. Scheduled tasks created in the last 7 days (common persistence)
$tasks = Get-ScheduledTask | Where-Object {$_.Date -gt $cutoff -and $_.Author -notmatch 'Microsoft'}
foreach ($t in $tasks) {
    $report += [pscustomobject]@{Check='New Scheduled Task'; Value="$($t.TaskName) by $($t.Author)"; Risk='INVESTIGATE'}
}

# 3. Volume Shadow Copy status — extortion crews delete these pre-encryption/pre-leak
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [pscustomobject]@{Check='Shadow Copies'; Value='NONE FOUND — possible vssadmin deletion'; Risk='CRITICAL'}
} else {
    $report += [pscustomobject]@{Check='Shadow Copies'; Value="$($shadows.Count) present"; Risk='OK'}
}
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 200 -ErrorAction SilentlyContinue |
    Where-Object {$_.TimeCreated -gt $cutoff -and $_.Message -match 'Volume Shadow Copy.*(stopped|disabled)'}
if ($vssEvents) {
    $report += [pscustomobject]@{Check='VSS Service Stopped'; Value="$($vssEvents.Count) events in 7d"; Risk='CRITICAL'}
}

# 4. Unauthorized RMM tooling (ScreenConnect/AnyDesk/TeamViewer = CVE-2024-1708 adjacency & persistence)
$rmmPaths = @('C:\Program Files*\ScreenConnect*','C:\Program Files*\AnyDesk*','C:\Program Files*\TeamViewer*','C:\Program Files*\Splashtop*')
foreach ($p in $rmmPaths) {
    if (Test-Path $p) { $report += [pscustomobject]@{Check='RMM Tool Present'; Value=$p; Risk='INVESTIGATE — authorized?'} }
}

# 5. Recent outbound sessions on exfil-favored ports
$net = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object {$_.RemotePort -in 21,22,993,2049,443 -and $_.OwningProcess -notin (Get-Process -Name svchost,msedge,chrome,firefox -ErrorAction SilentlyContinue).Id}
foreach ($c in ($net | Select-Object -First 10)) {
    $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $report += [pscustomobject]@{Check='Outbound Connection'; Value="$proc -> $($c.RemoteAddress):$($c.RemotePort)"; Risk='INVESTIGATE'}
}

$report | Format-Table -AutoSize
$report | Export-Csv ".\ShinyHunters_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Triage complete. Review CRITICAL/HIGH findings immediately." -ForegroundColor Yellow