ShinyHunters Healthcare Data Theft Campaign — Defense and Detection Guide

---
title: ShinyHunters Web Shell Execution via Web Server Process
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential web shell activity where a web server process spawns a command shell or script interpreter, a common TTP for ShinyHunters persistence.
references:
  - https://health-isac.org/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\php-cgi.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative debugging by web administrators
level: high
---
title: ShinyHunters Database Dumping Activity
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious command-line arguments used for database dumping, often used by ShinyHunters to steal PHI before extortion.
references:
  - https://health-isac.org/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_keywords:
    CommandLine|contains:
      - 'mysqldump'
      - 'pg_dump'
      - 'sqldump'
      - 'SELECT * INTO OUTFILE'
  selection_suspicious_loc:
    CommandLine|contains:
      - '\Temp\'
      - '\Windows\Temp\'
      - 'C:\Users\Public\'
  condition: 1 of selection*
falsepositives:
  - Legitimate database maintenance performed by DBAs
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for suspicious outbound data transfers from web servers
// ShinyHunters often exfiltrates data via HTTP/HTTPS to C2 or drop sites
let WebServers = DeviceProcessEvents
| where ProcessName in~("w3wp.exe", "httpd.exe", "nginx.exe")
| distinct DeviceId;
DeviceNetworkEvents
| where DeviceId in (WebServers)
| where ActionType in ("ConnectionSuccess", "ConnectionAllowed")
| where RemotePort in (80, 443, 8080)
| where InitiatingProcessFileName in~("w3wp.exe", "httpd.exe", "php-cgi.exe")
| where SentBytes > 10485760 // Greater than 10MB
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, SentBytes
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for recent file modifications in web directories
-- ShinyHunters often drops web shells or readme files in web roots
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*/*/wwwroot/**/*")
WHERE Mtime > now() - 7d
  AND (Name =~ "\.php" OR Name =~ "\.aspx" OR Name =~ "\.txt")
  AND NOT IsDir


**Remediation Script (PowerShell)**

# Script to audit IIS directories for suspicious web shell indicators
# Requires Administrator privileges

$WebRoots = @(
    "C:\inetpub\wwwroot",
    "C:\xampp\htdocs",
    "D:\websites"
)

$SuspiciousPatterns = @(
    "base64_decode",
    "eval\(\$",
    "shell_exec",
    "system\(\$",
    "passthru",
    "assert\(\$"
)

foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Write-Host "Scanning $Root..." -ForegroundColor Cyan
        
        # Find recently modified PHP/ASPX files (last 7 days)
        $RecentFiles = Get-ChildItem -Path $Root -Recurse -Include *.php, *.aspx, *.ashx, *.jsp 
                        | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        
        if ($RecentFiles) {
            Write-Host "Found $($RecentFiles.Count) recently modified script files." -ForegroundColor Yellow
            
            foreach ($File in $RecentFiles) {
                $Content = Get-Content $File.FullName -Raw -ErrorAction SilentlyContinue
                if ($Content) {
                    foreach ($Pattern in $SuspiciousPatterns) {
                        if ($Content -match $Pattern) {
                            Write-Host "[!] Suspicious content found in: $($File.FullName)" -ForegroundColor Red
                            # Output details for forensic review
                            Write-Host "    - Pattern Match: $Pattern"
                            Write-Host "    - LastWriteTime: $($File.LastWriteTime)"
                        }
                    }
                }
            }
        } else {
            Write-Host "No recently modified script files found." -ForegroundColor Green
        }
    }
}