University of Copenhagen Data Breach: 520,000 Records Exposed — Detection and Response Playbook for Defenders

---
title: Mass Archive Creation in Web-Accessible or Temp Directories
id: 9c4e2b17-6a3d-4f58-b291-7d8e5c0a1f34
status: experimental
description: Detects compression utilities creating archives in web roots, temp, or staging directories — a common data staging behavior prior to exfiltration of bulk records.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winzip.exe'
      - '\tar.exe'
      - '\makecab.exe'
  selection_path:
    CommandLine|contains:
      - '\inetpub\'
      - '\wwwroot\'
      - '\Temp\'
      - '\tmp\'
      - 'AppData\Local\Temp'
  condition: selection_tool and selection_path
falsepositives:
  - Legitimate backup jobs — whitelist known service accounts and scheduled task paths
level: high
---
title: Database Dump Utility Execution by Non-Service Account
id: 3f8a1d54-2e7b-4c96-a835-9b1d4e6f2a07
status: experimental
description: Detects execution of database export/dump utilities by interactive or unusual accounts, indicating potential bulk extraction of student, HR, or citizen records.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\osql.exe'
      - '\mongoexport.exe'
  filter_backup:
    CommandLine|contains:
      - 'maintenance'
      - 'backup'
  condition: selection and not filter_backup
falsepositives:
  - DBA activity and scheduled maintenance — baseline authorized accounts and tighten the filter
level: high
---
title: Web Server Process Spawning Command Shell
id: 61b7f4a2-8d3e-4c19-b542-e0a6d3c81f95
status: experimental
description: Detects a web server or database service process spawning a command shell, a strong indicator of web shell deployment or SQL injection leading to command execution — a frequent entry vector in university and public-sector breaches.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
      - '\sqlservr.exe'
      - '\php.exe'
      - '\php-cgi.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy applications shell out for report generation — investigate every hit
level: critical

// Hunt 1: Endpoints sending abnormally large volumes to rare external destinations
let baseline = DeviceNetworkEvents
| where TimeGenerated > ago(30d) and TimeGenerated <= ago(1d)
| summarize AvgBytes = avg(tolong(0)), Destinations = dcount(RemoteIP) by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where ActionType == "ConnectionSuccess"
| summarize RecentConnections = count(), UniqueRemoteIPs = dcount(RemoteIP), RemoteUrls = make_set(RemoteUrl, 50) by DeviceName, InitiatingProcessAccountName
| join kind=leftouter baseline on DeviceName
| where UniqueRemoteIPs > 3 * Destinations or isnull(Destinations)
| project DeviceName, InitiatingProcessAccountName, RecentConnections, UniqueRemoteIPs, RemoteUrls
| order by UniqueRemoteIPs desc;

// Hunt 2: Archive/dump tool execution clustered on servers (Syslog ingestion for Linux DB/web tier)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("mysqldump", "pg_dump", "mongoexport", "tar", "zip")
| summarize Executions = count(), DistinctUsers = dcount(SyslogMessage), SampleCmd = any(SyslogMessage) by Computer, ProcessName, bin(TimeGenerated, 1h)
| order by Executions desc;

// Hunt 3: Single account authenticating to an unusual number of servers (post-credential-theft lateral movement)
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624 and LogonType in (3, 10)
| summarize ServerCount = dcount(Computer), Servers = make_set(Computer, 40) by Account
| where ServerCount > 15
| order by ServerCount desc;

-- Hunt for recently created large archives outside known backup paths (data staging indicator)
SELECT FullPath, Size, Mtime, Atime,
       basename(path=FullPath) AS FileName
FROM glob(globs='C:/Users/*/AppData/Local/Temp/*.zip',
          accessor='ntfs')
WHERE Size > 10000000
ORDER BY Mtime DESC

-- Check for dump/export processes currently running on database servers
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)mysqldump|pg_dump|mongoexport|sqlcmd|bcp'
   OR CommandLine =~ '(?i)into outfile|backup database|\.dump'

-- Netstat sweep for established sessions to rare external IPs from server VLANs
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Raddr !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'
ORDER BY Raddr

# Security Arsenal — Mass-Exfiltration Exposure Audit (Windows app/DB tier)
# Run elevated. Produces a findings report; remediates nothing automatically — review first.

$report = @()

# 1) Detect database dump/export tooling accessible outside the DB install path
$dumpTools = Get-ChildItem -Path 'C:\' -Include 'mysqldump.exe','pg_dump.exe','mongoexport.exe','bcp.exe' -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -notmatch 'Program Files.*(MySQL|PostgreSQL|MongoDB|Microsoft SQL Server)' }
foreach ($t in $dumpTools) { $report += "[HIGH] Dump tool in unexpected location: $($t.FullName)" }

# 2) Find large archives staged in web roots or temp (last 30 days)
$paths = @('C:\inetpub\wwwroot', "$env:SystemDrive\Windows\Temp", "$env:TEMP")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -Include *.zip,*.7z,*.rar,*.tar,*.gz -ErrorAction SilentlyContinue |
      Where-Object { $_.Length -gt 10MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
      ForEach-Object { $report += "[HIGH] Large recent archive staged: $($_.FullName) ($([math]::Round($_.Length/1MB)) MB)" }
  }
}

# 3) Audit process creation with command line (required for Sigma rules above to function)
$audit = auditpol /get /subcategory:"Process Creation" 2>$null
if ($audit -notmatch 'Success') {
  auditpol /set /subcategory:"Process Creation" /success:enable | Out-Null
  $report += "[FIXED] Enabled 'Audit Process Creation' (Success)"
}
$cmdline = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
if (-not $cmdline -or $cmdline.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
  Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
  $report += "[FIXED] Enabled command-line capture in process creation events"
}

# 4) Verify outbound egress filtering exists for server VLANs (defender must confirm firewall-side)
$report += "[ACTION] Confirm firewall egress rules: DB/app servers should reach ONLY approved update/mgmt destinations. Deny-by-default outbound on the server VLAN stops most exfil cold."

# 5) Check MFA enforcement indicator: NPS/ADFS not directly auditable here — flag for review
$report += "[ACTION] Verify MFA is enforced (not optional) on all SSO-federated apps, VPN, and admin portals. Review legacy-protocol exclusions (IMAP/SMTP/basic auth) — disable them."

$report | Out-File "$env:USERPROFILE\Desktop\ExfilExposure-Audit.txt"
$report

#!/bin/bash
# Security Arsenal — Linux DB/web tier exposure audit
# Run as root on student-records/HR database and web servers.

echo "=== [1] Dump utilities in web-accessible or temp paths ==="
find /var/www /srv/www /tmp /var/tmp -type f \( -name 'mysqldump' -o -name 'pg_dump' \) 2>/dev/null

echo "=== [2] Large archives staged in web roots or temp (last 30 days) ==="
find /var/www /srv/www /tmp /var/tmp -type f \( -name '*.zip' -o -name '*.tar*' -o -name '*.gz' -o -name '*.7z' \) -size +10M -mtime -30 2>/dev/null -exec ls -lh {} \;

echo "=== [3] World-readable database exports or SQL dumps on disk ==="
find / -type f \( -name '*.sql' -o -name '*.dump' \) -perm -o+r -size +1M 2>/dev/null | head -20

echo "=== [4] Web server processes with shell children RIGHT NOW ==="
for pid in $(pgrep -x apache2; pgrep -x nginx; pgrep -x httpd; pgrep -x php-fpm); do
  children=$(ps --ppid "$pid" -o comm= 2>/dev/null | grep -E 'bash|sh|dash|zsh|nc|curl|wget')
  [ -n "$children" ] && echo "ALERT: web PID $pid spawned: $children"
done

echo "=== [5] Egress check: can this server reach arbitrary internet hosts on 443? ==="
timeout 5 curl -s -o /dev/null -w "Outbound 443 reachable (should FAIL on a DB server): %{http_code}\n" https://example.com || echo "OK: outbound blocked or filtered"

echo "=== [6] Recent sequential-record scraping pattern in web access logs ==="
# Fires when one IP pulls an abnormal volume of record-detail pages (IDOR-style scraping)
awk '{print $1}' /var/log/apache2/access.log 2>/dev/null | sort | uniq -c | sort -rn | head -10