2026 Healthcare Enterprise Advisory: Countering Ransomware & Credential Theft

---
title: Potential Ransomware Preparation - VSSAdmin Shadow Copy Deletion
id: 92a0f6c3-1c20-4f5b-9e50-123456789abc
status: experimental
description: Detects the deletion of volume shadow copies using vssadmin.exe, a common precursor to ransomware encryption to prevent recovery.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t1490
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '\vssadmin.exe'
   CommandLine|contains:
     - 'delete shadows'
     - 'resize shadowstorage'
falsepositives:
 - Legitimate system administration tasks (rare in automated fashion)
level: high
---
title: Suspicious PowerShell Encoded Command - Likely Credential Harvesting
id: b5d8e2a1-4f3c-4d5e-9b1a-9876543210ab
status: experimental
description: Detects PowerShell processes utilizing EncodedCommand parameters, often used to obfuscate malicious scripts related to credential dumping.
references:
 - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '\powershell.exe'
   CommandLine|contains:
     - '-enc '
     - '-EncodedCommand '
 condition: selection
falsepositives:
 - Legitimate software installation scripts
 - System management automation
level: medium

// Hunt for suspicious mass file access or modification patterns indicative of ransomware
// or reconnaissance activity in healthcare file shares
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType in ("FileCreated", "FileModified")
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| where FolderPath has any ("\\PACS", "\\EHR", "\\MedicalRecords", "\\PatientData")
| summarize count() by DeviceName, InitiatingProcessFileName, FolderPath, AccountName
| where count_ > 10 // Threshold for mass activity

-- Hunt for processes accessing LSASS memory, a key indicator of credential theft
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'lsass.exe'
  AND (
    -- Check for handle access attempts potentially indicating dumping
    CommandLine =~ ' -r '
    OR Name =~ 'procdump'
    OR Name =~ 'rundll32'
  )
-- Note: In a real scenario, querying handle access requires specific kernel artifacts.
-- This query serves as a basic filter for common dumping tools.

# Healthcare Enterprise Hardening Script
# Enables critical audit policies and checks for basic security misconfigurations

# 1. Enable Advanced Audit Policy for Credential Validation
Write-Host "[+] Enabling Audit Credential Validation..."
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable | Out-Null

# 2. Check for LAPS Installation (Critical for healthcare workstations)
$lapsInstalled = Get-WindowsFeature -Name LAPS
if (-not $lapsInstalled.Installed) {
    Write-Host "[WARNING] LAPS is not installed. Please implement LAPS immediately for local admin management."
} else {
    Write-Host "[+] LAPS is installed."
}

# 3. Enable Windows Defender Real-time Monitoring if disabled
$mpPreference = Get-MpPreference
if ($mpPreference.DisableRealtimeMonitoring -eq $true) {
    Write-Host "[!] Real-time monitoring is DISABLED. Enabling..."
    Set-MpPreference -DisableRealtimeMonitoring $false
} else {
    Write-Host "[+] Real-time monitoring is ACTIVE."
}

Write-Host "[*] Hardening script completed."