Clarinda Regional Health Center Breach: Defending Against Large-Scale PHI Exfiltration

---
title: Potential Bulk Data Staging via Archiving Software
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of common archiving tools (WinRAR, 7-Zip) on file servers or workstations, often used to stage bulk data for exfiltration during healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
  filter_legit_admin:
    ParentImage|contains: 'Program Files'
  condition: selection and not filter_legit_admin
falsepositives:
  - Legitimate administrative backups (rare on endpoints)
  - User personal file compression
level: high
---
title: Suspicious Mass File Access via PowerShell
id: 1b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects PowerShell scripts attempting to recursively access or list large numbers of files, indicative of reconnaissance or data staging prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.discovery
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - 'Get-Item'
      - 'ls '
      - 'dir '
    CommandLine|contains:
      - '-Recurse'
      - '-rec'
  filter_legit:
    ParentImage|contains:
      - '\System32\'
  condition: selection and not filter_legit
falsepositives:
  - System administration scripts
  - Backup software dependencies
level: medium

// Hunt for unusual sign-ins to health portals from impossible travel or rare locations
let HighRiskLocations = materialize(
    SigninLogs
    | where TimeGenerated > ago(7d)
    | summarize Count() by Location, City
    | where Count_ < 5 // Filter for rare locations
    | project Location
);
SigninLogs
| where TimeGenerated > ago(3d)
| where AppDisplayName in~ ("Epic Hyperspace", "Cerner", "Meditech", "Allscripts") // Common EHR Apps
| where Location in (HighRiskLocations)
| project TimeGenerated, UserPrincipalName, AppDisplayName, Location, DeviceDetail, RiskDetails
| order by TimeGenerated desc

-- Hunt for recently created archives (zip, rar, 7z) in user directories
-- which may indicate staged data for exfiltration
SELECT FullPath, Size, Mtime, Mode.Data
FROM glob(globs="/*/*.{zip,rar,7z,iso}")
WHERE Mtime > now() - 24h
   AND Size > 10000000 // Larger than 10MB

# Script to Audit User Group Memberships for new additions (Persistence Check)
# Helps identify if new accounts were added to privileged groups during the breach

$EventLog = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4728 or EventID=4732 or EventID=4756)]] and *[System[TimeCreated[timediff(@SystemTime) <= 604800000]]]" -ErrorAction SilentlyContinue

if ($EventLog) {
    Write-Host "[+] Found recent group membership changes in the last 7 days:" -ForegroundColor Yellow
    $EventLog | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "[INFO] No recent privileged group additions detected." -ForegroundColor Green
}

# Check for active RDP sessions (Potential lateral movement)
$RDPSessions = query user | Select-Object -Skip 1
if ($RDPSessions) {
    Write-Host "[!] Active RDP Sessions detected:" -ForegroundColor Yellow
    $RDPSessions
}