August 2026 Healthcare Data Breach Report: What HHS Filings Reveal and How to Defend Your Organization

---
title: IIS Worker Process Spawning Command Shell - Healthcare Web Portal Exploitation
id: 3f9c2e71-8a44-4b9d-a6e2-7c1d5f8a2b03
status: experimental
description: Detects w3wp.exe spawning cmd.exe, PowerShell, or other command interpreters, a high-fidelity indicator of web shell execution following exploitation of an internet-facing healthcare web application such as a patient portal.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legacy web applications that legitimately invoke system commands - investigate and tune by application pool identity
level: critical
---
title: Archive Utility Execution in Data Staging Locations
id: 8b1d4a96-2c37-4e58-b9f1-4d6a7e3c9f52
status: experimental
description: Detects execution of compression utilities (7-Zip, WinRAR, Compress-Archive) with archive output staged to ProgramData, temp, or other non-standard directories - a hallmark of PHI collection and staging prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1074/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' u '
  selection_paths:
    CommandLine|contains:
      - 'C:\ProgramData'
      - '\AppData\Local\Temp'
      - 'C:\Temp'
      - 'C:\Users\Public'
  selection_ps:
    CommandLine|contains:
      - 'Compress-Archive'
  condition: (selection_tools and selection_cli and selection_paths) or (selection_ps and selection_paths)
falsepositives:
  - IT backup or packaging scripts - exclude known administrative accounts and scheduled task paths
level: high
---
title: Database Client Tool Execution on Non-Database Server
id: 5e7a9c14-6f28-4d3b-91c8-2e4b6a8d1f07
status: experimental
description: Detects execution of command-line database client tools (sqlcmd, osql, mysql, mysqldump, psql) on systems outside an approved database server baseline - consistent with bulk querying or dumping of EHR/PHI databases during intrusion.
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sqlcmd.exe'
      - '\osql.exe'
      - '\mysql.exe'
      - '\mysqldump.exe'
      - '\psql.exe'
  filter_dbservers:
    Computer|contains:
      - '-DB-'
      - '-SQL-'
      - '-EHR-DB'
  condition: selection and not filter_dbservers
falsepositives:
  - Developers and report writers with legitimate client tools - maintain an approved host list and tune the filter to your naming convention
level: high

// Hunt 1: Web server spawning shells or staging archives - chain the two behaviors
// Run over 7 days against Defender for Endpoint telemetry
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "nltest.exe", "7z.exe", "rar.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated asc;

// Hunt 2: Outbound data transfer anomaly from servers - surfaces exfil following staging
// Baseline against your own environment; threshold of 5 GB/day per device is a starting point
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceType == "Server" or DeviceName has_any ("EHR", "SQL", "DB", "FILE")
| where RemoteIPType == "Public"
| summarize TotalBytesOut = sum(BytesSent), UniqueDestinations = dcount(RemoteIP) by DeviceName, bin(TimeGenerated, 1d)
| where TotalBytesOut > 5000000000
| order by TotalBytesOut desc;

// Hunt 3: Identity-layer detection for mailbox compromise (ingest via SigninLogs / AuditLogs)
// New inbox forwarding rules created outside change windows
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("New-InboxRule", "Set-InboxRule")
| extend RuleDetail = tostring(TargetResources[0].modifiedProperties)
| where RuleDetail has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo")
| project TimeGenerated, OperationName, UserPrincipalName = tostring(TargetResources[0].userPrincipalName), InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), RuleDetail
| order by TimeGenerated desc

-- Hunt artifact: PHI staging indicators across endpoints
-- Looks for recently created large archives in common staging directories
-- and suspicious child processes of web servers

-- Part 1: Recent archive files in staging locations (last 14 days, >50MB)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/ProgramData/**/*.zip',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar',
  'C:/Users/*/AppData/Local/Temp/**/*.7z',
  'C:/Users/Public/**/*.zip',
  'C:/Users/Public/**/*.7z'
])
WHERE Mtime > now() - 1209600
  AND Size > 52428800
ORDER BY Mtime DESC

-- Part 2: Suspicious child processes of IIS worker processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
  SELECT Pid FROM pslist() WHERE Name =~ 'w3wp'
)
AND Name =~ '(?i)cmd|powershell|pwsh|whoami|net|cscript|wscript|mshta'

# Healthcare Breach Vector Audit - Windows / IIS environments
# Run as Administrator. Read-only audit: identifies web shells, rogue inbox indicators,
# weak audit policy, and verifies EDR coverage on PHI-hosting systems.

# 1. Scan IIS web roots for recently created/modified script files (potential web shells)
$webRoots = @("C:\inetpub\wwwroot")
$cutoff = (Get-Date).AddDays(-30)
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.ashx,*.php,*.jsp -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-Object FullName, LastWriteTime, Length |
            Export-Csv -Path "C:\Audit_WebRootChanges.csv" -NoTypeInformation
    }
}
Write-Host "[+] Web root scan complete. Review C:\Audit_WebRootChanges.csv for unexpected script files." -ForegroundColor Green

# 2. Flag w3wp.exe child processes from the last 7 days (requires Sysmon or process auditing)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'w3wp\.exe' -and $_.Message -match '(cmd\.exe|powershell\.exe|whoami\.exe|net\.exe)' } |
    Select-Object TimeCreated, Message |
    Export-Csv -Path "C:\Audit_WebShellProcess.csv" -NoTypeInformation
Write-Host "[+] Process audit complete. Any rows in C:\Audit_WebShellProcess.csv require immediate triage." -ForegroundColor Green

# 3. Verify file-access auditing is enabled on PHI shares (required to detect bulk reads)
$auditPol = auditpol /get /subcategory:"File System" 2>$null
if ($auditPol -notmatch "Success") {
    Write-Host "[!] File System auditing is NOT capturing Success events. Enable it to detect bulk PHI access:" -ForegroundColor Red
    Write-Host '    auditpol /set /subcategory:"File System" /success:enable /failure:enable' -ForegroundColor Yellow
} else {
    Write-Host "[+] File System success auditing is enabled. Confirm SACLs exist on PHI shares." -ForegroundColor Green
}

# 4. Verify PowerShell Script Block and Module logging (HIPAA-relevant forensic visibility)
$psLog = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue
if (-not $psLog -or $psLog.EnableScriptBlockLogging -ne 1) {
    Write-Host "[!] Script Block Logging disabled. Enabling..." -ForegroundColor Red
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
    Write-Host "[+] Script Block Logging enabled." -ForegroundColor Green
}

# 5. Confirm EDR sensor presence and service health on servers hosting ePHI
$edr = Get-Service -Name "Sense" -ErrorAction SilentlyContinue
if ($edr -and $edr.Status -eq "Running") {
    Write-Host "[+] Microsoft Defender for Endpoint sensor is running." -ForegroundColor Green
} else {
    Write-Host "[!] MDE sensor not found/running - verify your EDR agent on this host immediately." -ForegroundColor Red
}