Back to Blog
    Cybersecurity
    ShinyHunters
    Oracle PeopleSoft
    Detection Engineering
    SOC
    MITRE ATT&CK
    SIEM
    Splunk
    Threat Intelligence

    ShinyHunters' Oracle PeopleSoft Campaign: 8 Detection Use Cases Every SOC Should Deploy

    SecTower Team
    July 16, 2026
    5 min read
    ShinyHunters' Oracle PeopleSoft Campaign: 8 Detection Use Cases Every SOC Should Deploy

    Threat actors continue to prove that internet-facing enterprise applications remain one of the most attractive attack vectors. The latest campaign analyzed by Google Threat Intelligence Group highlights how ShinyHunters leveraged a zero-day vulnerability in Oracle PeopleSoft to compromise organizations—particularly within the education sector—before patches became available. The campaign combined remote code execution, persistence, credential theft, remote management tooling, and data exfiltration to maximize impact.

    While Oracle PeopleSoft is the primary target in this campaign, the detection opportunities extend far beyond Oracle environments. Organizations using Splunk Enterprise Security, Microsoft Sentinel, QRadar, Elastic, Chronicle, or any mature SIEM should implement behavioral detections that identify attacker techniques instead of relying solely on signatures or IOCs.

    Attack Overview

    According to Google's research, the attackers exploited vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) endpoints to gain initial access. After exploitation they deployed additional tooling, established persistence, abused remote management software, harvested credentials, and attempted to exfiltrate sensitive information.

    Observed attacker behaviors included:

    • Exploitation of exposed PeopleSoft services
    • Installation of JSP webshells
    • XMLDecoder abuse
    • MeshCentral remote management deployment
    • DNS communications to attacker-controlled infrastructure
    • SMB authentication coercion
    • SSH propagation attempts
    • Web defacement markers
    • Command and control over HTTPS

    These techniques map closely to multiple MITRE ATT&CK tactics including Initial Access, Persistence, Credential Access, Lateral Movement, Command and Control, and Impact.

    Recommended Detection Engineering Use Cases

    UC1 — Detect Exploitation Attempts Against Oracle PeopleSoft

    MITRE: T1190 – Exploit Public-Facing Application

    Monitor inbound HTTP POST requests targeting:

    • /PSEMHUB/hub
    • /PSIGW/HttpListeningConnector

    from external IP addresses.

    This represents the highest-fidelity indicator of exploitation attempts and should generate immediate investigation when observed against internet-facing PeopleSoft systems.

    Recommended Data Sources

    • Web server logs
    • Reverse proxy logs
    • WAF
    • Palo Alto
    • F5
    • Cloudflare
    • Akamai

    UC2 — Detect Communication with Known Malicious Infrastructure

    Attackers frequently reuse staging infrastructure during campaigns.

    Build a lookup containing known malicious IP addresses published by threat intelligence providers and generate alerts whenever:

    • outbound connections occur
    • inbound sessions originate
    • firewall activity references these IPs

    MITRE: T1071, T1583

    This detection has very high confidence and low false-positive rates when supported by quality intelligence feeds.

    UC3 — Detect DNS Requests for Malicious Infrastructure

    MITRE: T1071.004

    Google identified attacker infrastructure using domains associated with:

    azurenetfiles.net

    Although the domain appears cloud-related, it is designed to blend into normal enterprise traffic.

    Monitor DNS resolution from:

    • Infoblox
    • Microsoft DNS
    • Zscaler DNS
    • Cisco Umbrella

    Correlate DNS lookups with outbound HTTPS sessions for stronger fidelity.

    UC4 — Detect Outbound SMB Traffic from PeopleSoft Servers

    MITRE: T1187 – Forced Authentication

    Application servers rarely require outbound SMB communication.

    Monitor Oracle PeopleSoft hosts initiating:

    • TCP/445
    • SMB sessions
    • NTLM authentication

    Unexpected outbound SMB can indicate:

    • NetNTLM coercion
    • relay attacks
    • credential harvesting
    • lateral movement preparation

    UC5 — Detect SSRF Attempts Against PSIGW

    MITRE: T1190, T1210

    Inspect HTTP requests sent to PSIGW components for references to:

    • 127.0.0.1
    • localhost
    • RFC1918 addresses
    • internal hostnames
    • cloud metadata endpoints

    These patterns often indicate Server-Side Request Forgery (SSRF) attempts designed to pivot into internal resources.

    UC6 — Detect JSP Webshell and XMLDecoder Persistence

    MITRE: T1505.003 – Web Shell

    Monitor PeopleSoft web servers for:

    • new JSP files
    • modified JSP files
    • XMLDecoder execution
    • suspicious Java process creation
    • unexpected webroot changes

    Combining file integrity monitoring with endpoint telemetry significantly improves detection accuracy.

    UC7 — Detect SSH Spray Activity and Defacement Artifacts

    MITRE: T1110.001, T1021.004

    Google observed attacker activity involving:

    • *_fanout.sh
    • automated SSH attempts
    • README-style defacement files

    Recommended detections include:

    • rapid SSH authentication failures
    • execution of fanout scripts
    • creation of ransom notes
    • filesystem monitoring for known filenames

    UC8 — Detect MeshCentral Remote Management Installation

    MITRE: T1219 – Remote Access Software

    One of the more interesting aspects of the campaign was the deployment of customized MeshCentral agents disguised as legitimate software.

    Detection opportunities include:

    • executable filename monitoring
    • SHA-256 IOC matching
    • new service creation
    • scheduled task creation
    • outbound TLS sessions to unusual infrastructure
    • unsigned binary execution

    Behavioral monitoring is particularly valuable because attackers frequently rename remote management binaries.

    Why Behavioral Detection Matters

    One of the biggest lessons from this campaign is that traditional IOC detection alone is insufficient.

    Infrastructure changes.

    Hashes change.

    Domains rotate.

    However, attacker behavior tends to remain remarkably consistent.

    Organizations that detect:

    • unusual HTTP requests
    • abnormal SMB traffic
    • suspicious DNS lookups
    • unauthorized remote management tools
    • webshell persistence

    will identify both known and future variants of this attack.

    Behavior-based detections also remain effective after threat actors rotate infrastructure or recompile malware.

    How SecTower Can Help

    At SecTower, we specialize in designing high-fidelity detection engineering content for Splunk Enterprise Security and other leading SIEM platforms.

    Our services include:

    • Custom Splunk detection engineering
    • MITRE ATT&CK mapping
    • Threat hunting content
    • Risk-Based Alerting (RBA)
    • SIEM content optimization
    • Detection tuning and false-positive reduction
    • Threat intelligence integration
    • SOC maturity assessments

    Whether your environment uses Splunk, Microsoft Sentinel, Elastic, Chronicle, or QRadar, our team can help transform threat intelligence into actionable detections that improve security operations.

    The best time to build detections is before attackers arrive—not after an incident has already occurred.