ShinyHunters Extortion Crackdown: Defending Against SaaS Data Theft and Insider-Enabled Extortion After Executive Arrest

---
title: Bulk Data Export from SaaS Platform via Credential Access
id: 3f8c2a91-7b4e-4d12-9a56-8e1f0c2d5b7a
status: experimental
description: Detects mass download or bulk export behavior consistent with ShinyHunters-style SaaS data theft, where compromised or insider accounts perform large-scale data extraction from cloud platforms.
references:
  - https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: webserver
  product: salesforce
  service: api
detection:
  selection:
    Operation:
      - 'ReportExport'
      - 'DataExport'
      - 'BulkApiQuery'
      - 'AsyncApiQuery'
  filter_known_scheduled:
    LoginHistory_Application:
      - 'DataLoaderScheduled'
      - 'ETL Integration User'
  condition: selection and not filter_known_scheduled
falsepositives:
  - Scheduled data warehouse syncs and sanctioned ETL jobs — baseline service accounts and exclude them explicitly
level: high
---
title: Mass File Download from Cloud Storage by Single Principal
id: 9d4e7b12-3c6a-4f89-b2d1-5a0e8c7f3d29
status: experimental
description: Detects a single user or process accessing an abnormally high number of files in cloud storage (SharePoint, OneDrive, Google Drive, S3) within a short window, consistent with staging for extortion-driven data theft.
references:
  - https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
  - attack.exfiltration
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
      - 'GetObject'
  condition: selection
falsepositives:
  - Backup agents and DLP scanners — correlate with known service principals
level: medium
---
title: Endpoint Access to Browser Credential Stores Followed by Cloud Authentication
id: 5b2f8e41-9d3c-4a76-8e24-1f6b0d9c4a58
status: experimental
description: Detects processes reading browser credential databases (Login Data, cookies) on endpoints, a precursor to session token theft and SaaS account takeover used by extortion groups and their access suppliers.
references:
  - https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\logins.json'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_paths and not filter_browsers
falsepositives:
  - EDR and DLP agents scanning user profiles — tune by known sensor process paths
level: high

// Hunt 1: Anomalous bulk export activity in Salesforce/M365 audit data ingested to Sentinel
let lookback = 7d;
let threshold = 500; // tune to your environment's baseline export volume
OfficeActivity
| where TimeGenerated > ago(lookback)
| where Operation in~ ("FileDownloaded", "FileSyncDownloadedFull", "Export")
| summarize FileCount = count(), DistinctFiles = dcount(OfficeObjectId), Sites = dcount(Site_Url) by UserId, SourceIP = ClientIP, bin(TimeGenerated, 1h)
| where FileCount > threshold
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | project UserPrincipalName, IPAddress, Location, AppDisplayName, AuthenticationRequirement, RiskLevelDuringSignIn
    ) on $left.UserId == $right.UserPrincipalName
| project TimeGenerated, UserId, FileCount, DistinctFiles, SourceIP, Location, RiskLevelDuringSignIn, AuthenticationRequirement
| order by FileCount desc;

// Hunt 2: Processes touching browser credential stores (session token theft precursor)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("Login Data", "Cookies", "Web Data", "logins.json", "key4.db")
| where FolderPath has_any ("Chrome", "Edge", "Firefox", "Brave")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "MsMpEng.exe")
| summarize AccessCount = count(), Devices = dcount(DeviceName) by InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by AccessCount desc;

// Hunt 3: Privileged/security-team accounts authenticating from unusual infrastructure (insider-risk lens)
SigninLogs
| where TimeGenerated > ago(14d)
| extend Parsed = parse_json(NetworkLocationDetails)
| where ResultType == 0
| summarize Locations = make_set(Location), IPs = make_set(IPAddress), FirstSeen = min(TimeGenerated) by UserPrincipalName
| where array_length(IPs) > 15 // high IP churn consistent with VPN/anonymizer rotation
| join kind=inner (
    IdentityInfo
    | where TimeGenerated > ago(14d)
    | where JobTitle has_any ("security", "soc", "incident", "admin")
    | project AccountUPN, JobTitle
    ) on $left.UserPrincipalName == $right.AccountUPN
| project UserPrincipalName, JobTitle, IPs, Locations, FirstSeen

-- Hunt for non-browser processes accessing browser credential stores
-- Relevant to session-token theft and insider data staging scenarios
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(Login Data|Cookies|Web Data|logins\.json|key4\.db|Local State)'
  AND Name !~ '(?i)^(chrome|msedge|firefox|brave)\.exe$'

-- Correlate: recent executions from user-writable staging directories
-- commonly used to aggregate data before exfiltration
SELECT FullPath,
       Size,
       Mtime,
       Btime
FROM glob(glob='C:/Users/*/AppData/Local/Temp/**/*.zip',
          accessor='ntfs')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

# Requires elevation. Validates and enables ASR rule for credential theft prevention.

# ASR rule: Block credential stealing from LSASS
$asrRules = @{
    '9e6c4e1f-7d60-472f-b1a1-a39ef669e4b9' = 'Block credential stealing from LSASS'
    'd1e49aac-8f56-4280-b9ba-993a6d77406c' = 'Block process creations from PSExec/WMI'
}

foreach ($rule in $asrRules.GetEnumerator()) {
    $current = (Get-MpPreference).AttackSurfaceReductionRules_Ids
    if ($current -notcontains $rule.Key) {
        Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions Enabled
        Write-Output "[+] Enabled ASR rule: $($rule.Value)"
    } else {
        Write-Output "[=] ASR rule already present: $($rule.Value)"
    }
}

# Enable auditing of sensitive file access (browser credential stores) on endpoints
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Write-Output "[+] File system auditing enabled"

# Verify LSA Protection (RunAsPPL) is configured to resist credential dumping
$ppl = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue
if ($null -eq $ppl -or $ppl.RunAsPPL -ne 1) {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -Value 1
    Write-Output "[+] LSA Protection (RunAsPPL) enabled - reboot required"
} else {
    Write-Output "[=] LSA Protection already enabled"
}

# Report current ASR state for validation
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids