Amgen Cloud Supply Chain Breach: Detection and Defense Strategies for Healthcare Organizations

---
title: Suspicious Mass Data Access in Cloud Storage
id: 8c1f5e2a-3d4b-4f8e-a1c9-6d2e4f3a1b5c
status: experimental
description: Detects potential data exfiltration through unusually high volume of cloud storage access
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.exfiltration
  - attack.t1530
logsource:
  category: cloud_storage
detection:
  selection:
    Operation|contains:
      - 'GetObject'
      - 'Download'
    ObjectSize:
      - gt: 104857600  # 100MB threshold
  timeframe: 1h
  condition: selection | count() > 10
falsepositives:
  - Legitimate large data transfers by administrators
  - Scheduled backup processes
level: high
---
title: Third-Party Provider Access to Sensitive Data
id: 5d3e9b1a-4c6d-4e8f-a9c2-7e3f6a5b4d3e
status: experimental
description: Detects unusual access to patient health information from third-party provider accounts
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1195
logsource:
  category: cloud_provider_access
detection:
  selection:
    AccountType: 'ThirdParty'
    DataClassification:
      - 'PHI'
      - 'PatientHealth'
    AccessTime:
      - outside_business_hours
  condition: selection
falsepositives:
  - Authorized third-party access for legitimate business purposes
  - Emergency maintenance activities
level: medium
---
title: Unusual Geographic Access to Cloud Healthcare Data
id: 2a5f8c7d-3e4f-5a6b-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects access to healthcare data from unusual geographic locations
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1078
logsource:
  category: cloud_access
detection:
  selection:
    ResourceType:
      - 'HealthcareData'
      - 'PatientRecords'
    Country|notcontains:
      - 'United States'
      - 'OrganizationAllowedCountries'
  condition: selection
falsepositives:
  - Authorized remote access by traveling employees
  - Legitimate access from global research partners
level: high

// Detect unusual access patterns to cloud storage containing sensitive healthcare data
let threshold = 20;
let timeWindow = 1h;
CloudStorageEvents
| where TimeGenerated >= ago(timeWindow)
| where ObjectClass =~ "HealthcareData" or Tags has "PHI"
| summarize AccessCount = count(), DistinctUsers = dcount(UserPrincipalName), SizeAccessedMB = sum(ObjectSize/1024/1024) by UserPrincipalName, ResourceGroup, SubscriptionId, IpAddress
| where AccessCount > threshold or SizeAccessedMB > 500
| project TimeGenerated, UserPrincipalName, ResourceGroup, SubscriptionId, IpAddress, AccessCount, DistinctUsers, SizeAccessedMB, RiskScore = AccessCount * 0.5 + SizeAccessedMB * 0.5
| order by RiskScore desc
| extend AlertDetails = strcat("Unusual access pattern detected: ", UserPrincipalName, " accessed ", AccessCount, " objects totaling ", SizeAccessedMB, "MB from ", IpAddress)


// Detect potential data exfiltration through unusual data transfer volumes to external endpoints
let baselineThreshold = 2.0; // 200% of normal baseline
let timeWindow = 1h;
let timeframe = 7d;
// Calculate baseline transfer volume per user
let baselineData = CloudNetworkEvents
| where TimeGenerated between(ago(timeframe) .. ago(timeWindow))
| where Direction == "Outbound"
| summarize BaselineTransferMB = sum(BytesTransferred/1024/1024) by UserPrincipalName, DestinationIp
| project-away BaselineTransferMB; // Placeholder for actual baseline calculation
// Detect anomalies against baseline
CloudNetworkEvents
| where TimeGenerated >= ago(timeWindow)
| where Direction == "Outbound"
| summarize TransferVolumeMB = sum(BytesTransferred/1024/1024), ConnectionCount = count() by UserPrincipalName, DestinationIp, DestinationPort, ProcessName
| join kind=leftouter (baselineData) on UserPrincipalName, DestinationIp
| where isnotnull(TransferVolumeMB)
| extend Ratio = iff(BaselineTransferMB > 0, TransferVolumeMB / BaselineTransferMB, 10.0) // Default high ratio if no baseline
| where Ratio > baselineThreshold or TransferVolumeMB > 1000 // Significant increase or large volume
| project TimeGenerated, UserPrincipalName, DestinationIp, DestinationPort, ProcessName, TransferVolumeMB, ConnectionCount, Ratio
| order by Ratio desc


// Detect privilege escalation activities by third-party accounts
CloudAuditLogs
| where TimeGenerated >= ago(1d)
| where OperationName in ("AssignRole", "AddRoleAssignment", "GrantAccess", "CreatePolicyAssignment")
| where CallerType == "ServicePrincipal" or Caller contains any ("third-party", "vendor", "provider")
| extend PrincipalName = Caller, TargetResource = tostring(TargetResources[0].displayName), RoleName = tostring(TargetResources[0].properties.roleDefinitionId)
| project TimeGenerated, PrincipalName, OperationName, TargetResource, RoleName, IpAddress, Result
| where Result == "success"
| order by TimeGenerated desc

-- Hunt for unusual file access patterns related to healthcare data
SELECT
  FullPath,
  Size,
  Mode,
  Sys.Uname as Username,
  Sys.Hostname as Hostname,
  Mtime
FROM glob(globs="/*/*/Documents/**/*", root=srcDir="/")
WHERE Name =~ "(patient|health|medical|phi|records|diagnosis|treatment)"
  AND Size > 10485760  -- Files larger than 10MB
  AND Mtime > now() - 24h  -- Modified in last 24 hours
ORDER BY Mtime DESC
LIMIT 50


-- Monitor for connections to cloud storage endpoints from unusual locations
SELECT
  Client.RemoteAddress,
  Client.Port,
  Client.ProcessName,
  Client.Pid,
  Client.Username,
  Server.Port,
  Server.Address,
  ConnectionState
FROM netstat()
WHERE Server.Address =~ "(s3\.amazonaws\.com|blob\.core\.windows\.net|storage\.googleapis\.com)"
  AND NOT Client.RemoteAddress =~ "^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)"
  AND ConnectionState =~ "(ESTABLISHED)"
ORDER BY Server.Address

# Cloud Storage Security Audit for Healthcare Environments
# This script checks for security configurations that could prevent data breaches like Amgen's

function Audit-CloudStorageSecurity {
    param (
        [string]$SubscriptionId,
        [string]$ResourceGroupName
    )
    
    Write-Host "Starting cloud storage security audit for healthcare data protection..." -ForegroundColor Cyan
    
    # Check 1: Identify storage accounts containing healthcare/PHI data
    Write-Host "\n[CHECK 1] Identifying storage accounts with potential healthcare data..." -ForegroundColor Yellow
    $storageAccounts = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName
    foreach ($account in $storageAccounts) {
        $containers = Get-AzStorageContainer -Context $account.Context
        foreach ($container in $containers) {
            $blobs = Get-AzStorageBlob -Container $container.Name -Context $account.Context -MaxCount 5
            foreach ($blob in $blobs) {
                if ($blob.Name -match "patient|health|medical|phi|records") {
                    Write-Host "  [ALERT] Potential healthcare data found in: $($account.StorageAccountName)/$($container.Name)/$($blob.Name)" -ForegroundColor Red
                }
            }
        }
    }
    
    # Check 2: Verify third-party access controls
    Write-Host "\n[CHECK 2] Auditing third-party access permissions..." -ForegroundColor Yellow
    $roleAssignments = Get-AzRoleAssignment -Scope "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName"
    $thirdPartyPrincipals = $roleAssignments | Where-Object { 
        $_.SignInName -match "vendor|provider|third-party|external" -or 
        $_.ObjectType -eq "ServicePrincipal"
    }
    
    if ($thirdPartyPrincipals) {
        Write-Host "  [ALERT] Found $($thirdPartyPrincipals.Count) third-party principals with access:" -ForegroundColor Red
        foreach ($principal in $thirdPartyPrincipals) {
            Write-Host "    - $($principal.DisplayName) ($($principal.RoleDefinitionName))" -ForegroundColor Yellow
        }
    } else {
        Write-Host "  [PASS] No suspicious third-party access found" -ForegroundColor Green
    }
    
    # Check 3: Verify encryption settings
    Write-Host "\n[CHECK 3] Verifying encryption settings for storage accounts..." -ForegroundColor Yellow
    foreach ($account in $storageAccounts) {
        if ($account.Encryption.KeySource -ne "Microsoft.Keyvault") {
            Write-Host "  [ALERT] Storage account $($account.StorageAccountName) not using customer-managed keys" -ForegroundColor Red
        } else {
            Write-Host "  [PASS] Storage account $($account.StorageAccountName) using customer-managed keys" -ForegroundColor Green
        }
    }
    
    # Check 4: Audit network access rules
    Write-Host "\n[CHECK 4] Auditing network access rules..." -ForegroundColor Yellow
    foreach ($account in $storageAccounts) {
        $networkRules = $account.NetworkRuleSet
        if ($networkRules.DefaultAction -ne "Deny") {
            Write-Host "  [ALERT] Storage account $($account.StorageAccountName) allows public access" -ForegroundColor Red
        } else {
            Write-Host "  [PASS] Storage account $($account.StorageAccountName) restricts public access" -ForegroundColor Green
        }
    }
    
    Write-Host "\nAudit completed. Review alerts and implement remediation as needed." -ForegroundColor Cyan
}

# Example usage:
# Audit-CloudStorageSecurity -SubscriptionId "your-subscription-id" -ResourceGroupName "your-resource-group"