Amicus Solutions Breach Impacting Huntsville Hospital Health System — Third-Party Vendor Risk Detection and Remediation for Healthcare Defenders

---
title: Suspicious Vendor Account Authentication Outside Normal Business Hours
id: a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects authentication events from third-party vendor accounts outside expected business hours, a common indicator of credential compromise in supply chain attacks affecting healthcare environments.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://www.hipaajournal.com/data-breaches-amicus-solutions-huntsville-hospital-health-system/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1199
logsource:
  category: process_creation
  product: windows
detection:
  selection_vendor_account:
    SubjectUserName|contains:
      - 'svc_amicus'
      - 'svc_vendor'
      - 'amicus'
      - 'fedora'
      - 'vendor_'
      - '_3rdparty'
      - '_external'
  filter_business_hours:
    TimeGenerated|gte: '08:00:00'
    TimeGenerated|lte: '18:00:00'
  condition: selection_vendor_account and not filter_business_hours
falsepositives:
  - Legitimate emergency vendor maintenance windows
  - Scheduled after-hours batch processing by vendor accounts
level: high
---
title: Abnormal Data Volume Transfer from Healthcare Systems via Vendor Credentials
id: b2c3d4e5-6f7a-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects large file operations or data transfers initiated by vendor service accounts that exceed normal baseline activity, indicating potential PHI exfiltration through compromised third-party credentials.
references:
  - https://attack.mitre.org/techniques/T1567/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.collection
  - attack.t1213
logsource:
  category: file_access
  product: windows
  service: security
detection:
  selection_vendor:
    SubjectUserName|contains:
      - 'svc_amicus'
      - 'svc_vendor'
      - 'amicus'
      - 'fedora'
      - 'vendor_'
      - '_3rdparty'
  selection_sensitive_paths:
    ObjectName|contains:
      - '\\\\EHR\\'
      - '\\\\fileshare\\patient'
      - '\\\\fileshare\\PHI'
      - '\\\\clinical\\'
      - '\\\\billing\\'
      - '\\\\healthcare\\'
  condition: selection_vendor and selection_sensitive_paths
falsepositives:
  - Legitimate scheduled data processing by vendor applications
  - Approved data migration activities
level: high
---
title: Vendor Account Network Connection to Non-Standard External Endpoints
id: c3d4e5f6-7a8b-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects network connections from systems using vendor service accounts to external IP addresses or domains not associated with the vendor's known infrastructure, suggesting data exfiltration or C2 communication.
references:
  - https://attack.mitre.org/techniques/T1567/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection_vendor_process:
    User|contains:
      - 'svc_amicus'
      - 'svc_vendor'
      - 'amicus'
      - 'fedora'
  selection_external:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_vendor_infra:
    DestinationHostname|endswith:
      - '.amicus-solutions.com'
      - '.fedorasolutions.com'
  condition: selection_vendor_process and not selection_external and not filter_known_vendor_infra
falsepositives:
  - Legitimate vendor cloud service connections (requires baseline tuning)
  - Vendor remote support tools connecting to their own infrastructure
level: high

// Hunt for anomalous vendor account activity across healthcare environment
// Targets: vendor account logins outside business hours, bulk file access,
// and external network connections from vendor-authenticated sessions

let vendorAccountPattern = @'(?i)(svc_amicus|svc_vendor|amicus|fedora|vendor_|_3rdparty|_external)';
let lookback = 14d;
let businessHours = time(8 .. 18);

// 1. Vendor account authentications outside normal business hours
let authAnomalies = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4624, 4625)
| where AccountType == 'User'
| where Account matches regex vendorAccountPattern
| extend HourOfDay = hourofday(TimeGenerated)
| where HourOfDay !in range(8, 18)
| project TimeGenerated, Account, Computer, LogonType, IpAddress, HourOfDay, Activity
| summarize AuthCount = count(), DistinctComputers = makeset(Computer), DistinctIPs = makeset(IpAddress)
    by Account, bin(TimeGenerated, 1h);

// 2. Vendor account bulk file access on sensitive healthcare shares
let fileAccessAnomalies = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4663, 4656, 4660)
| where Account matches regex vendorAccountPattern
| where ObjectType == 'File'
| where ObjectName has_any ('EHR', 'patient', 'PHI', 'clinical', 'billing', 'healthcare')
| summarize FileAccessCount = count(), DistinctFiles = dcount(ObjectName), FileList = makeset(ObjectName)
    by Account, Computer, bin(TimeGenerated, 1h)
| where FileAccessCount > 50;

// 3. Vendor process network connections to external destinations
let networkAnomalies = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessAccountName matches regex vendorAccountPattern
| where not(ipv4_is_private(RemoteIP))
| where RemoteUrl !endswith ('amicus-solutions.com')
| where RemoteUrl !endswith ('fedorasolutions.com')
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP), RemoteIPList = makeset(RemoteIP)
    by InitiatingProcessAccountName, DeviceName, bin(TimeGenerated, 1h)
| where ConnectionCount > 10;

// Combine results for unified alert view
authAnomalies
| extend AnomalyType = 'AfterHoursAuth'
| union (fileAccessAnomalies | extend AnomalyType = 'BulkFileAccess')
| union (networkAnomalies | extend AnomalyType = 'ExternalNetworkConnection')
| sort by TimeGenerated desc

-- Hunt for vendor account activity, suspicious process execution,
-- and data staging artifacts across healthcare endpoints

LET vendor_accounts = SELECT Name, Description FROM users() 
  WHERE Name =~ '(?i)(svc_amicus|svc_vendor|amicus|fedora|vendor_|_3rdparty|_external)';

-- Find processes running under vendor accounts
LET vendor_processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ '(?i)(svc_amicus|svc_vendor|amicus|fedora|vendor_|_3rdparty|_external)'
ORDER BY CreateTime DESC;

-- Look for data staging artifacts in temp directories
LET staging_artifacts = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.zip',
  'C:/Users/*/AppData/Local/Temp/*.7z',
  'C:/Users/*/AppData/Local/Temp/*.rar',
  'C:/Users/*/AppData/Local/Temp/staged*',
  'C:/Temp/*.zip',
  'C:/Temp/*.7z',
  'C:/Temp/export*'
])
WHERE Size > 10485760
ORDER BY Mtime DESC
LIMIT 100;

-- Check for unusual network connections from vendor-associated processes
LET vendor_network = SELECT Pid, Name, Laddr, Raddr, Status, Username
FROM netstat()
WHERE Username =~ '(?i)(svc_amicus|svc_vendor|amicus|fedora|vendor_|_3rdparty|_external)'
  AND NOT Raddr.IP =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)';

-- Return combined results
SELECT * FROM (
  SELECT 'VendorProcess' AS FindingType, 
         to_string(Pid) AS Identifier, Name, CommandLine, Username, CreateTime AS Timestamp
  FROM vendor_processes
  
  UNION
  
  SELECT 'DataStaging' AS FindingType,
         FullPath AS Identifier, to_string(Size) AS Name, '' AS CommandLine, '' AS Username, Mtime AS Timestamp
  FROM staging_artifacts
  
  UNION
  
  SELECT 'VendorNetworkConnection' AS FindingType,
         to_string(Pid) AS Identifier, Name, to_string(Raddr) AS CommandLine, Username, '' AS Timestamp
  FROM vendor_network
)
ORDER BY Timestamp DESC

<#
.SYNOPSIS
    Vendor Access Audit and Credential Remediation Script
.DESCRIPTION
    Following the Amicus Solutions breach pattern, this script audits all third-party
    vendor accounts in Active Directory, identifies stale access, rotates credentials,
    and generates a compliance report for HIPAA breach response documentation.
.NOTES
    Run with Domain Admin privileges from a Domain Controller or RSAT-equipped workstation.
    Author: Security Arsenal
    Date: 2026-04-06
#>

# ============================================================
# 1. IDENTIFY ALL VENDOR AND THIRD-PARTY ACCOUNTS
# ============================================================

$vendorPatterns = @('*amicus*', '*fedora*', '*vendor*', '*3rdparty*', '*external*', '*svc_*', '*service_*')
$reportDir = 'C:\SecurityArsenal\VendorAudit'
New-Item -ItemType Directory -Force -Path $reportDir | Out-Null
$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'

Write-Host '[*] Scanning Active Directory for vendor and third-party accounts...' -ForegroundColor Cyan

$vendorAccounts = foreach ($pattern in $vendorPatterns) {
    Get-ADUser -Filter {SamAccountName -like $pattern} -Properties 
        SamAccountName, DisplayName, Description, LastLogonDate, PasswordLastSet, 
        MemberOf, Enabled, Created, LastBadPasswordAttempt |
    Select-Object SamAccountName, DisplayName, Description, Enabled, Created,
        LastLogonDate, PasswordLastSet, LastBadPasswordAttempt,
        @{Name='GroupMembership'; Expression={$_.MemberOf -join '; '}}
}

$vendorAccounts | Export-Csv -Path "$reportDir\vendor_accounts_audit_$timestamp.csv" -NoTypeInformation
Write-Host "[+] Found $($vendorAccounts.Count) vendor accounts. Report saved to $reportDir\vendor_accounts_audit_$timestamp.csv" -ForegroundColor Green

# ============================================================
# 2. IDENTIFY STALE ACCOUNTS (No login in 30+ days but still enabled)
# ============================================================

$staleThreshold = (Get-Date).AddDays(-30)
$staleAccounts = $vendorAccounts | Where-Object {
    $_.Enabled -eq $true -and
    ($_.LastLogonDate -lt $staleThreshold -or $null -eq $_.LastLogonDate)
}

Write-Host "[!] Found $($staleAccounts.Count) stale vendor accounts (enabled but no login in 30+ days)." -ForegroundColor Yellow
$staleAccounts | Export-Csv -Path "$reportDir\stale_vendor_accounts_$timestamp.csv" -NoTypeInformation

# ============================================================
# 3. DISABLE STALE VENDOR ACCOUNTS (with -WhatIf for safety)
# ============================================================

Write-Host '[*] Disabling stale vendor accounts...' -ForegroundColor Cyan
foreach ($account in $staleAccounts) {
    Write-Host "    Disabling: $($account.SamAccountName) - Last Logon: $($account.LastLogonDate)" -ForegroundColor Yellow
    # Remove -WhatIf to execute in production after review
    Disable-ADAccount -Identity $account.SamAccountName -WhatIf
}

# ============================================================
# 4. ROTATE PASSWORDS FOR ACTIVE VENDOR ACCOUNTS
# ============================================================

Write-Host '[*] Resetting passwords for active vendor accounts...' -ForegroundColor Cyan
$activeVendorAccounts = $vendorAccounts | Where-Object { $_.Enabled -eq $true }

foreach ($account in $activeVendorAccounts) {
    $newPassword = -join ((48..57) + (65..90) + (97..122) + (33..47) | Get-Random -Count 32 | ForEach-Object {[char]$_})
    $securePassword = ConvertTo-SecureString -String $newPassword -AsPlainText -Force
    
    # Remove -WhatIf to execute in production after review
    Set-ADAccountPassword -Identity $account.SamAccountName -NewPassword $securePassword -WhatIf
    
    Write-Host "    Password reset for: $($account.SamAccountName)" -ForegroundColor Green
    # Log password reset (DO NOT log the actual password in production)
    Add-Content -Path "$reportDir\password_rotation_log_$timestamp.txt" `
        -Value "$timestamp - Password rotated for account: $($account.SamAccountName)"
}

# ============================================================
# 5. AUDIT VENDOR GROUP MEMBERSHIPS AND EXCESSIVE PRIVILEGES
# ============================================================

Write-Host '[*] Auditing vendor group memberships for excessive privileges...' -ForegroundColor Cyan

$privilegedGroups = @('Domain Admins', 'Enterprise Admins', 'Administrators', 
    'Schema Admins', 'Server Operators', 'Account Operators', 'Backup Operators')

$excessivePrivileges = foreach ($group in $privilegedGroups) {
    $groupMembers = Get-ADGroupMember -Identity $group -RecursiveErrorAction SilentlyContinue
    foreach ($member in $groupMembers) {
        if ($member.SamAccountName -match '(?i)(amicus|fedora|vendor|3rdparty|external|svc_)') {
            [PSCustomObject]@{
                VendorAccount = $member.SamAccountName
                PrivilegedGroup = $group
                RiskLevel = 'CRITICAL'
            }
        }
    }
}

if ($excessivePrivileges) {
    Write-Host "[!] CRITICAL: Vendor accounts found in privileged groups!" -ForegroundColor Red
    $excessivePrivileges | Format-Table -AutoSize
    $excessivePrivileges | Export-Csv -Path "$reportDir\excessive_privileges_$timestamp.csv" -NoTypeInformation
} else {
    Write-Host '[+] No vendor accounts found in privileged groups.' -ForegroundColor Green
}

# ============================================================
# 6. GENERATE SUMMARY REPORT
# ============================================================

$summary = [PSCustomObject]@{
    AuditDate = Get-Date
    TotalVendorAccounts = $vendorAccounts.Count
    ActiveAccounts = ($vendorAccounts | Where-Object Enabled -eq $true).Count
    DisabledAccounts = ($vendorAccounts | Where-Object Enabled -eq $false).Count
    StaleAccounts = $staleAccounts.Count
    PasswordsRotated = $activeVendorAccounts.Count
    ExcessivePrivilegeFindings = if ($excessivePrivileges) { $excessivePrivileges.Count } else { 0 }
    ReportLocation = $reportDir
}

$summary | Format-List
$summary | Export-Csv -Path "$reportDir\audit_summary_$timestamp.csv" -NoTypeInformation

Write-Host "\n[*] Audit complete. All reports saved to: $reportDir" -ForegroundColor Cyan
Write-Host '[*] Review all findings before executing remediation actions (remove -WhatIf flags).' -ForegroundColor Yellow


---