Brown Health Medical Group-MA Breach: 311,000 Patient Records Exposed via Legacy File Server — Detection and Hardening Guide

---
title: Mass Archive Creation in Sensitive Healthcare Directories
id: 8c2f4a71-3b9d-4e58-a1c6-7f0d2b5e9a31
status: experimental
description: Detects compression utilities creating archives targeting directories likely to contain PHI or financial records on file servers. A common data staging behavior prior to exfiltration in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://securityaffairs.com/196681/uncategorized/brown-health-medical-group-ma-data-breach-exposes-information-of-311000-individuals.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
      - '\tar.exe'
      - '\makecab.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - 'archive'
  condition: selection_tool and selection_cmd
falsepositives:
  - Scheduled backup scripts using compression on known service accounts
  - Legitimate IT archiving tasks during business hours
level: high
---
title: Suspicious Process Execution on File Server Hosts
id: 4d7e9b12-6a3c-4f85-b2d9-1e8c0a4f7b62
status: experimental
description: Detects interactive shells, reconnaissance utilities, and scripting interpreters executing on Windows file server hosts. Legacy file servers should have near-zero interactive execution; any shell or enumeration tool is high-signal.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.execution
  - attack.t1059
  - attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\whoami.exe'
  filter_known_admins:
    User|contains:
      - 'svc_backup'
      - 'svc_sccm'
  condition: selection and not filter_known_admins
falsepositives:
  - Administrators performing legitimate maintenance; restrict with known admin account list
  - Monitoring and management agents
level: medium
---
title: Cloud Sync and Exfiltration Tool Execution
id: 2b5a8e04-9d1f-4c73-a6e8-3f7b0d9c4a15
status: experimental
description: Detects execution of common data exfiltration utilities (Rclone, MEGA sync, WinSCP scripting) frequently used to move stolen data off file servers to attacker-controlled cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAsync.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
      - '\curl.exe'
  condition: selection
falsepositives:
  - Approved backup solutions using Rclone; whitelist by path and service account
  - IT file transfer tooling
level: high

let SensitiveServers = dynamic(["FILESERVER", "LEGACY", "SHARE", "NAS"]); // tune to your naming convention
let Lookback = 14d;
let MassFileAccess =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName has_any (SensitiveServers)
    | where FolderPath has_any ("patient", "medical", "records", "phi", "billing", "finance", "hr")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | summarize FileOps=count(), DistinctFiles=dcount(FileName), FirstOp=min(TimeGenerated), LastOp=max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
    | where FileOps > 500; // tune threshold to baseline
let ArchiveStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName has_any (SensitiveServers)
    | where FileName has_any ("rar.exe", "7z.exe", "7za.exe", "tar.exe", "makecab.exe")
       or ProcessCommandLine has_any ("rar a", "7z a", ".rar", ".7z")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let ExfilTools =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName has_any (SensitiveServers)
    | where FileName has_any ("rclone.exe", "megasync.exe", "winscp.exe", "curl.exe", "filezilla.exe")
    | project ExfilTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
MassFileAccess
| join kind=inner ArchiveStaging on DeviceName
| project-away DeviceName1
| join kind=leftouter ExfilTools on DeviceName
| project-away DeviceName2
| order by FirstOp desc

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("FILESERVER", "LEGACY", "SHARE", "NAS")
| where RemoteIPType == "Public"
| where RemotePort in (443, 22, 21, 990)
| summarize Connections=count(), DistinctRemoteIPs=dcount(RemoteIP), RemoteIPs=make_set(RemoteIP, 20)
    by DeviceName, InitiatingProcessFileName, RemoteUrl
| where DistinctRemoteIPs > 10 or Connections > 1000
| order by Connections desc

-- Hunt for staging archives, suspicious processes, and outbound connections on file servers
SELECT * FROM foreach(
  row={
    SELECT FullPath, Size, Mtime
    FROM glob(globs=[
      'D:/Shares/**/*.rar',
      'D:/Shares/**/*.7z',
      'D:/Shares/**/*.zip',
      'C:/Users/*/AppData/Local/Temp/*.rar',
      'C:/Users/*/AppData/Local/Temp/*.7z'
    ])
    WHERE Mtime > now() - 1209600
  },
  query={
    SELECT 'archive' AS Category, FullPath AS Detail, Size, Mtime AS EventTime FROM scope()
  })

-- Interactive and staging processes on the host
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(rar|7z|rclone|megasync|winscp|net view|nltest|whoami|vssadmin delete)'
   OR Exe =~ '(?i)(temp|appdata|programdata)\\\\[^\\\\]+\\.exe$'

-- Established outbound connections from server processes
SELECT Pid, Name, Path, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Rport =~ '^(443|22|21|990)$'
  AND NOT Raddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'

# Requires elevation. Run on file server hosts. Review all changes before applying.

# 1) Identify end-of-support OS — legacy servers must be isolated or migrated
$os = Get-CimInstance Win32_OperatingSystem
$legacyBuilds = @("6.0","6.1")  # Server 2008 / 2008 R2
if ($legacyBuilds -contains ($os.Version -split '\.')[0..1] -join '.') {
    Write-Warning "LEGACY OS DETECTED: $($os.Caption). Isolate from network and plan migration immediately."
}

# 2) Disable SMBv1 server and client
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue

# 3) Enforce SMB signing to mitigate relay and tampering
Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSecuritySignature $true -Force

# 4) Inventory shares containing sensitive data
$keywords = 'patient|medical|record|phi|billing|finance|hr|payroll'
Get-SmbShare | Where-Object { $_.Path -match $keywords } | ForEach-Object {
    Write-Host "[SENSITIVE SHARE] $($_.Name) -> $($_.Path)"
    Get-SmbShareAccess -Name $_.Name | Format-Table Name, AccountName, AccessControlType, AccessRight
}

# 5) Enable detailed file share and file system auditing (Object Access)
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable

# 6) Apply SACLs to sensitive directories so reads are audited
$sensitivePaths = @("D:\Shares\PatientRecords","D:\Shares\Billing")  # tune to environment
foreach ($p in $sensitivePaths) {
    if (Test-Path $p) {
        $acl = Get-Acl $p -Audit
        $rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone","Read,Write,Delete","ContainerInherit,ObjectInherit","None","Success")
        $acl.AddAuditRule($rule)
        Set-Acl $p $acl
        Write-Host "[AUDIT ENABLED] $p"
    }
}

# 7) Restrict outbound traffic at host firewall — file servers rarely need Internet egress
New-NetFirewallRule -DisplayName "Block Outbound Internet from File Server" `
    -Direction Outbound -Action Block -RemoteAddress Internet `
    -Profile Any -ErrorAction SilentlyContinue

# 8) Verify configuration
Write-Host "`n=== VERIFICATION ==="
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignature
auditpol /get /subcategory:"File Share"