Aesto Health Data Breach: Third-Party Healthcare Vendor Incident — Detection, ePHI Exfiltration Hunting, and Remediation Guide

---
title: Bulk Archive Creation in Staging or Temp Directories
description: Detects compression utilities creating archives in temp/staging paths, a hallmark of data staging prior to exfiltration (T1560.001). Common in healthcare data theft where patient records are archived before outbound transfer.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/aesto-health-data-breach/
author: Security Arsenal
id: 3f8b2c41-9d1e-4a67-b3c2-8e5f7a1d9c04
status: experimental
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r '
  selection_path:
    CommandLine|contains:
      - '\Temp\'
      - '\tmp\'
      - 'AppData\Local\Temp'
      - 'C:\ProgramData\'
      - '\staging\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - Legitimate IT backup and packaging operations
  - Software deployment tooling compressing payloads
level: high
---
title: Potential Data Exfiltration via Cloud Storage or File Transfer Tools
description: Detects execution of common exfiltration tooling (rclone, curl to cloud endpoints, FTP clients) from servers that host or process ePHI. Aligned to vendor-breach tradecraft where stolen healthcare data is pushed to cloud buckets or attacker infrastructure (T1567.002).
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.hipaajournal.com/aesto-health-data-breach/
author: Security Arsenal
id: 7c1d4e92-5a3f-4b8d-9e61-2f4a8c6d0b17
status: experimental
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
  selection_curl_cloud:
    Image|endswith: '\curl.exe'
    CommandLine|contains:
      - 'blob.core.windows.net'
      - 's3.amazonaws.com'
      - 'storage.googleapis.com'
      - 'transfer.sh'
      - 'file.io'
      - 'mega.nz'
  selection_ftp:
    Image|endswith:
      - '\ftp.exe'
      - '\winscp.com'
      - '\psftp.exe'
      - '\filezilla.exe'
  condition: 1 of selection_*
falsepositives:
  - Sanctioned backup replication to cloud storage
  - IT administrators using WinSCP/FileZilla for maintenance
level: high
---
title: Suspicious Database Client Execution from Non-Database Servers
description: Detects interactive database client tooling (sqlcmd, mysql, psql, mongo) executing from application or file servers where it has no business running. In healthcare vendor breaches, attackers frequently dump patient databases using built-in or uploaded CLI clients (T1005).
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://www.hipaajournal.com/aesto-health-data-breach/
author: Security Arsenal
id: 9e2a6d53-1c8b-4f47-a2d9-5b3e7c8f1a26
status: experimental
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
  - attack.t1213
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sqlcmd.exe'
      - '\mysql.exe'
      - '\mysqldump.exe'
      - '\psql.exe'
      - '\pg_dump.exe'
      - '\mongoexport.exe'
      - '\osql.exe'
  filter_dbservers:
    Computer|contains:
      - '-DB-'
      - '-SQL-'
      - '-RDS-'
  condition: selection and not filter_dbservers
falsepositives:
  - Application servers legitimately running maintenance scripts
  - ETL jobs executing on integration servers
level: medium

// Hunt 1: Large outbound transfers from servers (potential ePHI exfiltration)
// Baseline first: adjust BytesSentThreshold to your environment
let BytesSentThreshold = 500000000; // 500 MB per host per day
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where ActionType == "ConnectionSuccess"
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| where RemoteUrl !has_any ("microsoft.com", "windowsupdate.com", "digicert.com", "symantec.com")
| summarize TotalBytesSent = sum(tolong(todynamic(AdditionalFields).bytes_sent)), Destinations = make_set(RemoteUrl, 20), RemoteIPs = make_set(RemoteIP, 20)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1d)
| where TotalBytesSent > BytesSentThreshold
| project TimeGenerated, DeviceName, InitiatingProcessFileName, TotalBytesSent, Destinations, RemoteIPs
| order by TotalBytesSent desc;

// Hunt 2: Archive staging + cloud exfil tool execution (Sysmon EID 1 via SecurityEvent or MDE)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe") and ProcessCommandLine has_any ("Temp", "ProgramData", "staging", " a ", " -r"))
   or (FileName =~ "rclone.exe" and ProcessCommandLine has_any ("copy", "sync", "move"))
   or (FileName =~ "curl.exe" and ProcessCommandLine has_any ("blob.core.windows.net", "s3.amazonaws.com", "storage.googleapis.com", "transfer.sh", "file.io"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName
| order by TimeGenerated desc;

// Hunt 3: Interactive database clients on non-database hosts (Linux Syslog ingestion variant)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("mysqldump", "mysql", "psql", "pg_dump", "mongoexport", "sqlcmd")
| where Computer !has_any ("-db-", "-sql-")  // adjust to your naming convention
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostUserName
| order by TimeGenerated desc

-- Aesto-style exfil hunt: staged archives + exfil tooling with live connections
-- Part 1: Large recently-created archives in temp/staging paths
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Windows/Temp/**/*.zip',
  'C:/Windows/Temp/**/*.7z',
  'C:/Windows/Temp/**/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/Users/*/AppData/Local/Temp/**/*.7z',
  'C:/Users/*/AppData/Local/Temp/**/*.rar',
  'C:/staging/**/*'
])
WHERE Size > 10000000
  AND Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Part 2: Exfil-capable processes with established external connections
SELECT Pid, Name, CommandLine, Address, Port, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Name =~ '(?i)(rclone|curl|winscp|filezilla|psftp|7z|rar|mysqldump|pg_dump)'
  AND NOT Address =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

# ============================================================
# ePHI Exfiltration Posture Audit - Security Arsenal
# Run elevated on servers hosting/processing patient data
# ============================================================

$report = @()
$stagingPaths = @("C:\Windows\Temp", "C:\ProgramData", "$env:PUBLIC")
$archiveExts  = @("*.7z", "*.rar", "*.zip", "*.tar.gz")
$exfilTools   = @("rclone.exe", "winscp.exe", "filezilla.exe", "psftp.exe", "megacmd.exe")

# 1. Hunt for large staged archives (created in last 14 days)
Write-Host "[*] Scanning for staged archives..." -ForegroundColor Cyan
foreach ($path in $stagingPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include $archiveExts -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -gt 10MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            ForEach-Object {
                $report += [PSCustomObject]@{
                    Finding = "Staged Archive"
                    Path    = $_.FullName
                    SizeMB  = [math]::Round($_.Length/1MB,2)
                    Modified= $_.LastWriteTime
                }
            }
    }
}

# 2. Check for exfil-capable tooling installed on ePHI servers
Write-Host "[*] Checking for exfiltration-capable tooling..." -ForegroundColor Cyan
foreach ($tool in $exfilTools) {
    $found = Get-ChildItem -Path "C:\" -Recurse -Filter $tool -ErrorAction SilentlyContinue -Depth 4
    foreach ($f in $found) {
        $report += [PSCustomObject]@{
            Finding = "Exfil Tool Present"
            Path    = $f.FullName
            SizeMB  = [math]::Round($f.Length/1MB,2)
            Modified= $f.LastWriteTime
        }
    }
}

# 3. Verify advanced audit policy: Process Creation + command line logging
Write-Host "[*] Verifying audit policy coverage..." -ForegroundColor Cyan
$audit = auditpol /get /subcategory:"Process Creation" 2>$null
if ($audit -notmatch "Success") {
    Write-Host "[!] Process Creation auditing NOT enabled - enabling now" -ForegroundColor Red
    auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable | Out-Null
}
$cmdLineAudit = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
if (-not $cmdLineAudit -or $cmdLineAudit.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
    Write-Host "[+] Command-line auditing enabled" -ForegroundColor Green
}

# 4. Enumerate large outbound connections in last 24h (netstat snapshot)
Write-Host "[*] Enumerating active external connections..." -ForegroundColor Cyan
$extConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|::1|fe80)" } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Finding = "External Connection"
            Path    = "$($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"
            SizeMB  = "-"
            Modified= (Get-Date)
        }
    }
$report += $extConns

# Output
$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\ephi-exfil-audit-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
Write-Host "[+] Audit complete. CSV exported." -ForegroundColor Green