Brockton Hospital Encryption Incident: Detecting Mass-File Encryption in Healthcare Environments

---
title: Potential Mass File Encryption Activity
id: a3b1c2d4-e5f6-7890-1234-56789abcdef0
status: experimental
description: Detects patterns consistent with ransomware mass file encryption by identifying processes modifying a high volume of files or specific file extensions rapidly. This rule correlates process creation with file change events where files are being overwritten or renamed with encrypted extensions.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    Image|endswith:
      - '\.exe'
      - '\.dll'
    TargetFilename|contains:
      - '\\Documents\\'
      - '\\Patients\\'
      - '\\MedicalRecords\\'
    TargetFilename|endswith:
      - '.locked'
      - '.encrypted'
      - '.crypt'
      - '.key'
  condition: selection
falsepositives:
  - Legitimate backup software compressing files
  - Database index rebuilding
level: high
---
title: Deletion of Volume Shadow Copies via VSSAdmin
id: b4c2d3e5-f6a7-8901-2345-67890abcdef1
status: experimental
description: Detects the use of vssadmin.exe to delete shadow copies, a common precursor to ransomware execution to prevent file recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - System administrators managing disk space (rare in automated bulk)
level: critical
---
title: Suspicious PowerShell Encoded Command Pattern
id: c5d3e4f6-a7b8-9012-3456-78901bcdef12
status: experimental
description: Detects PowerShell executing commands with specific encoded patterns often used by ransomware loaders to obfuscate malicious payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' -Enc '
      - ' -EncodedCommand '
      - 'FromBase64String'
    CommandLine|re: '^[A-Za-z0-9+/]{50,}={0,2}\s*$'
  condition: selection
falsepositives:
  - Legitimate system management scripts using encoding
level: medium

// Hunt for potential ransomware encryption via file modification velocity
let TimeFrame = 1h;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize FileCount = dcount(FileName), Extensions = makeset(Extension) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 5m)
| where FileCount > 50 // Threshold for suspicious mass file changes
| project-away InitiatingProcessCommandLine // Exclude in high-volume view if needed, or expand for IR
| sort by FileCount desc

-- Hunt for common ransomware note extensions and suspicious executables
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='C:\Users\*\*.locked')
LIMIT 50

-- Hunt for recently created suspicious executables in AppData (Common persistence)
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='C:\Users\*\AppData\Roaming\*.exe')
WHERE Mtime > now() - 24h

# Incident Response: Isolation and Triage Script
# Requires Administrator Privileges

Write-Host "[+] Starting Isolation and Triage Procedure..." -ForegroundColor Cyan

# 1. Disable Network Adapters to halt C2 and encryption spread
Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | ForEach-Object {
    Write-Host "[!] Disabling adapter: $($_.Name)" -ForegroundColor Yellow
    Disable-NetAdapter -Name $_.Name -Confirm:$false
}

# 2. Identify recently modified files (Potential encrypted files)
# Checks for files modified in the last 24 hours with common encrypted extensions
$extensions = @('.locked', '.encrypted', '.crypt', '.key', '.kraken')
$drive = Get-PSDrive -PSProvider FileSystem | Select-Object -First 1

Write-Host "[*] Scanning $($drive.Root) for recently modified suspicious files..."
$foundFiles = Get-ChildItem -Path $drive.Root -Recurse -Include $extensions -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }

if ($foundFiles) {
    Write-Host "[!] POTENTIAL RANSOMWARE FILES FOUND:" -ForegroundColor Red
    $foundFiles | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
} else {
    Write-Host "[-] No suspicious encrypted files found based on extension." -ForegroundColor Green
}

Write-Host "[+] Isolation Complete. Contact DFIR team." -ForegroundColor Green