Abbott Healthcare Breach: Legacy System Compromise & Exfiltration Hunt

---
title: Legacy Network Protocol Usage
id: a4b2c8d1-5e6f-4a3b-8c9d-1e2f3a4b5c6d
status: experimental
description: Detects usage of insecure legacy protocols often associated with medical devices or EOL systems, which are high-risk targets for data theft.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1048.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 21 # FTP
      - 23 # Telnet
      - 139 # NetBIOS
      - 445 # SMB (often filtered, but raw traffic on non-MS hosts is suspicious)
  filter_main_os:
    Image|contains: 
      - '\System32\'
      - '\Program Files\'
  condition: selection and not filter_main_os
falsepositives:
  - Legitimate administrative use of legacy equipment
level: medium
---
title: Data Staging via Archiving Utilities
id: b5c3d9e2-6f7a-5b4c-9d0e-2f3a4b5c6d7e
status: experimental
description: Detects execution of archiving tools (WinRAR, 7-Zip) with parameters indicating large file compression or multipart archiving, common during PHI exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\zip.exe'
  selection_params:
    CommandLine|contains:
      - '-m5' # Compression level max
      - '-v' # Volumes (splitting files)
      - '-hp' # Encrypt passwords
  condition: selection_tools and selection_params
falsepositives:
  - System backups or legitimate administrative archiving
level: high


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Legacy System Interactions and Data Transfer
let LegacyOS = dynamic(["Windows 7", "Windows Server 2008", "Windows Server 2012"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| extend OSVersion = tostring(DeviceInfo.OperatingSystem)
| where OSVersion has_any (LegacyOS) 
   or ProcessCommandLine contains "ftp" 
   or ProcessCommandLine contains "tftp" 
   or ProcessCommandLine contains "rc4" // Weak crypto often used in legacy scripts
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc


**Velociraptor VQL**

-- Hunt for connections to legacy ports (FTP, Telnet, SMB) and data staging
SELECT 
  Timestamp, 
  Pid, 
  Name, 
  Cmdline, 
  LocalAddress, 
  RemoteAddress, 
  RemotePort
FROM listen_sockets()
WHERE RemotePort IN (21, 23, 139, 445, 3389) 
   OR Name IN ("ftp.exe", "tftp.exe", "powershell.exe", "cmd.exe")


**Remediation Script (PowerShell)**

# Audit and Disable Legacy Protocols (SMBv1, Telnet Client)
Write-Host "[+] Checking SMBv1 Protocol Status..."
$smbv1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
if ($smbv1.State -eq "Enabled") {
    Write-Host "[!] WARNING: SMBv1 is Enabled. Disabling..." -ForegroundColor Red
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
} else {
    Write-Host "[*] SMBv1 is currently Disabled." -ForegroundColor Green
}

Write-Host "[+] Checking Telnet Client Status..."
$telnet = Get-WindowsOptionalFeature -Online -FeatureName TelnetClient
if ($telnet.State -eq "Enabled") {
    Write-Host "[!] WARNING: Telnet Client is Enabled. Disabling..." -ForegroundColor Red
    Disable-WindowsOptionalFeature -Online -FeatureName TelnetClient -NoRestart
} else {
    Write-Host "[*] Telnet Client is currently Disabled." -ForegroundColor Green
}

# Alert on legacy FTP services
Write-Host "[+] Checking for FTP Services..."
$ftpService = Get-Service -Name "MSFTPSVC" -ErrorAction SilentlyContinue
if ($ftpService) {
    Write-Host "[!] WARNING: IIS FTP Service is detected. Review configuration." -ForegroundColor Red
}