Detections

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Oracle PeopleSoft Suspicious PSEMHUB JSP File Write

sigma · generated; parse required before publication

title: Oracle PeopleSoft Suspicious PSEMHUB JSP File Write
description: Detects unauthorized JSP webshell creation in the Oracle PeopleSoft PSEMHUB application directory.
logsource:
  product: windows
  category: file_event
detection:
  selection:
    file.path: "*\\PSEMHUB.war\\*\\*.jsp"
  condition: selection
level: high
tags:
  - attack.persistence
  - attack.t1505.003
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/

ShinyHunters_Extortion_Marker

yara · compile required before publication

rule ShinyHunters_Extortion_Marker {
  strings:
    $s1 = "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT" ascii wide nocase
    $s2 = "csprd_fanout.sh" ascii wide nocase
    $s3 = "azurenetfiles.net" ascii wide nocase
  condition:
    any of them
}