Centers Lab Breach: 542K Records Compromised — Healthcare Data Defense & Exfiltration Detection

---
title: Potential Mass Data Exfiltration via Robocopy
id: 8a1f2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the use of robocopy with flags commonly used for bulk data copying and staging (e.g., /E, /COPYALL) often seen in data exfiltration or ransomware staging events.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\robocopy.exe'
    CommandLine|contains:
      - ' /E '
      - ' /COPYALL '
      - ' /MIR '
  condition: selection
falsepositives:
  - Legitimate system backups by IT administrators
level: high
---
title: Sensitive Directory Access by Non-Standard Process
id: 9b2e3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects access to paths commonly used for patient data or lab results (LIS) by processes other than the main LIS application or system services.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\PatientData\'
      - '\LabResults\'
      - '\LIS_Export\'
  filter_main:
    Image|contains:
      - '\LabApp.exe'
      - '\LIS_Service.exe'
  condition: selection and not filter_main
falsepositives:
  - Administrators manually reviewing files
level: medium
---
title: PowerShell Compression Script for Exfiltration
id: 0c3f4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PowerShell commands attempting to compress large directories using Compress-Archive or similar mechanisms, a common precursor to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Compress-Archive'
      - 'System.IO.Compression.ZipFile'
falsepositives:
  - Legitimate administrative scripting for backups
level: high

// Hunt for high volume file upload events often associated with exfiltration
// Focus on processes uploading to non-corporate IP ranges or high byte counts
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" 
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "robocopy.exe", "winscp.exe", "putty.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, SentBytes
| where SentBytes > 5000000 // Greater than 5MB
| order by Timestamp desc

-- Hunt for suspicious processes accessing sensitive directories
-- Look for command lines indicative of data dumping
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'cmd.exe' 
   OR Name =~ 'powershell.exe'
   OR Name =~ 'robocopy.exe'
   OR Name =~ 'python.exe'
-- Filter for suspicious patterns in command line
AND (CommandLine =~ 'copy ' 
     OR CommandLine =~ 'type ' 
     OR CommandLine =~ 'export '
     OR CommandLine =~ 'Compress-Archive')

# Audit Script: Identify Insecure Permissions on Common Data Shares
# Run this on file servers suspected of hosting PHI/LIS data

$SensitiveKeywords = @("Patient", "Lab", "Result", "PHI", "Medical", "LIS")
$Drives = @("C:", "D:", "E:")

Write-Host "[+] Starting Audit for Sensitive Directories with Weak Permissions..." -ForegroundColor Cyan

foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        # Find directories matching sensitive keywords
        $Dirs = Get-ChildItem -Path $Drive -Recurse -Directory -ErrorAction SilentlyContinue | 
                Where-Object { $SensitiveKeywords | Where-Object { $_ -in $_.Name.Split(" ") } }

        foreach ($Dir in $Dirs) {
            $Acl = Get-Acl -Path $Dir.FullName
            # Check for "Everyone" or "Authenticated Users" with Modify or FullControl
            $WeakAccess = $Acl.Access | Where-Object { 
                ($_.IdentityReference.Value -eq "Everyone" -or $_.IdentityReference.Value -eq "Authenticated Users") -and 
                ($_.FileSystemRights -match "Modify" -or $_.FileSystemRights -match "FullControl")
            }

            if ($WeakAccess) {
                Write-Host "[!] WEAK PERMISSION FOUND: $($Dir.FullName)" -ForegroundColor Red
                $WeakAccess | Format-Table IdentityReference, FileSystemRights -AutoSize
            }
        }
    }
}
Write-Host "[+] Audit Complete." -ForegroundColor Green