Astrana Health Data Breach: Defending Against Personnel Impersonation and Social Engineering Attacks in Healthcare

---
title: Suspicious Remote Access Tool Execution
description: Detects execution of legitimate remote access/RMM tools frequently abused by social engineers who convince employees to install 'IT support' software. Tune the allowlist for tools sanctioned in your environment.
id: 3f8a1c72-9b4e-4d67-bc12-3e5a8f9012aa
status: experimental
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.securityweek.com/astrana-health-data-breach-impacts-private-confidential-information/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\Splashtop.exe'
      - '\SRManager.exe'
      - '\dwagent.exe'
      - '\rustdesk.exe'
  filter_sanctioned:
    CommandLine|contains:
      - 'your-approved-rmm-path-or-switch'
  condition: selection and not filter_sanctioned
falsepositives:
  - Sanctioned IT support tooling — maintain an explicit allowlist of approved RMM products and deployment paths
level: high
---
title: Rapid MFA Method Change Followed by Anomalous Logon
description: Detects a new MFA device or authentication method registration on an account, a common artifact of help-desk social engineering where an attacker convinces staff to reset or re-enroll MFA.
id: 8b2e4d19-5c6a-4f78-ad23-9f1c2b3d4e5f
status: experimental
references:
  - https://attack.mitre.org/techniques/T1656/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'mfa'
      - 'authenticator'
      - 'enroll'
falsepositives:
  - Legitimate IT provisioning scripts — this rule is a placeholder for environments without IdP audit log ingestion; prefer KQL against Azure AD/Okta audit events where available
level: medium
---
title: Help Desk Password Reset via Command Line Outside Admin Tools
description: Detects local or domain password resets executed via command line rather than sanctioned identity management tooling, which can indicate an attacker operating with socially engineered access.
id: 1c9d7e45-2a3b-4c5d-8e6f-7a8b9c0d1e2f
status: experimental
references:
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith: '\net.exe'
    CommandLine|contains:
      - 'user'
      - '/domain'
    CommandLine|contains: '*'
  selection_adsi:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Set-ADAccountPassword'
      - 'Set-AzureADUserPassword'
      - 'Reset-ADUserPassword'
  condition: 1 of selection_*
falsepositives:
  - Help desk staff performing legitimate resets via CLI — correlate with ticket numbers and change windows
level: medium

// Hunt: Anomalous sign-ins combined with recent MFA/credential changes
// Surfaces accounts that had an authentication method modified and then
// logged in from a new location/device — the classic post-vishing pattern.
let lookback = 14d;
let mfaChanges =
    AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName has_any ("Add authentication method", "Update user", "Reset user password", "Update StsRefreshToken")
    | extend TargetUser = tostring(TargetResources[0].userPrincipalName)
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
    | project MFATime = TimeGenerated, TargetUser, Actor, OperationName;
let suspiciousSignins =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where ResultType == 0
    | summarize FirstSeenInWindow = min(TimeGenerated), Locations = make_set(Location), IPs = make_set(IPAddress), Devices = make_set(DeviceDetail)
        by UserPrincipalName
    | where array_length(Locations) > 2 or FirstSeenInWindow > ago(2d);
mfaChanges
| join kind=inner suspiciousSignins on $left.TargetUser == $right.UserPrincipalName
| project TargetUser, Actor, OperationName, MFATime, FirstSeenInWindow, Locations, IPs
| order by MFATime desc;

// Hunt: Execution of common RMM tooling on endpoints (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("AnyDesk.exe", "TeamViewer.exe", "ScreenConnect.ClientService.exe", "Splashtop.exe", "rustdesk.exe", "dwagent.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName
| order by TimeGenerated desc;

-- Hunt for unauthorized RMM tooling and recently created persistence artifacts
-- Deploy across the fleet to find machines where remote access software was
-- installed outside the sanctioned IT deployment path.
LET rmm_names = '(?i)(anydesk|teamviewer|screenconnect|splashtop|rustdesk|dwagent)'

SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ rmm_names
   OR Exe =~ rmm_names

-- Also enumerate recently created services for RMM persistence
SELECT Name, DisplayName, PathName, StartMode, State
FROM wmi_query(namespace='root/cimv2',
               query='SELECT Name, DisplayName, PathName, StartMode, State FROM Win32_Service')
WHERE PathName =~ rmm_names

# Astrana-style impersonation incident: audit and hardening script
# Run on a management host with appropriate AD/Entra rights.

# 1. Audit recent password resets and flag resets performed outside the help desk group
$lookback = (Get-Date).AddDays(-14)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724; StartTime=$lookback} |
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      Time        = $_.TimeCreated
      TargetUser  = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
      ResetBy     = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
    }
  } | Where-Object { $_.ResetBy -notin @('helpdesk_svc','iam_automation') } |
  Sort-Object Time -Descending | Format-Table -AutoSize

# 2. Find endpoints running unsanctioned RMM tooling
$rmm = 'anydesk|teamviewer|screenconnect|splashtop|rustdesk|dwagent'
Get-CimInstance Win32_Process | Where-Object { $_.Name -match $rmm } |
  Select-Object Name, ProcessId, CommandLine, @{N='User';E={$_.GetOwner().User}} |
  Format-Table -AutoSize

# 3. Enforce MFA registration protection (Entra ID): require re-registration via TAP
# Verify Temporary Access Pass policy is enabled for help desk-driven onboarding
Connect-MgGraph -Scopes 'Policy.Read.All'
Get-MgPolicyAuthenticationMethodPolicy |
  Select-Object Id, DisplayName, Description

# 4. Harden: block RMM executables not on the allowlist via AppLocker (example rule set)
# Generate AppLocker deny rules for common RMM tools in user-writable paths
$denyPaths = @(
  '%OSDRIVE%\Users\*\Downloads\AnyDesk.exe',
  '%OSDRIVE%\Users\*\Downloads\TeamViewer*.exe',
  '%OSDRIVE%\Users\*\AppData\*\rustdesk.exe'
)
$denyPaths | ForEach-Object { Write-Output "AppLocker deny candidate: $_" }
# Apply via New-AppLockerPolicy in your GPO pipeline after testing in audit mode first.