CNIL Fines Hôpital privé de la Loire €500,000 After Breach Exposes 727,000 Records — Healthcare Data Protection Lessons and Detection Guide

---
title: Bulk Patient Record Export from Database Host
tid: 4f8c2a1b-9d3e-4a6f-b1c7-2e5d8a9f0b3c
status: experimental
description: Detects database client tools or scripting utilities executing bulk export/dump operations against hosts that store patient records, a hallmark of mass healthcare data theft.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1530
  - attack.t1213
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\osql.exe'
  selection_args:
    CommandLine|contains:
      - 'outfile'
      - '--tab'
      - 'queryout'
      - ' -o '
      - 'SELECT *'
  condition: selection_tools or (selection_args and 1 of selection_tools)
falsepositives:
  - Scheduled database backup jobs run by service accounts from known backup hosts
  - DBA maintenance activity — whitelist by account and source host
level: high
---
title: Web Server or Application Process Spawning Data Staging Tools
tid: 8b3d5e7f-2c4a-4b8d-9e1f-3a6c0d2e4f5a
status: experimental
description: Detects web/application server worker processes spawning archiving or transfer utilities, consistent with an attacker staging extracted patient data for exfiltration via a compromised portal or API.
references:
  - https://attack.mitre.org/techniques/T1560/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\tomcat9.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\tar.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rclone.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Application deployment pipelines — restrict by known deploy accounts and paths
  - Legitimate log rotation using tar from web service accounts
level: high
---
title: Mass Archive Creation of Sensitive Healthcare Directories
tid: 1c6e9b4d-7f2a-4d5c-8b3e-6a0f1d8c2e4b
status: experimental
description: Detects compression of directories commonly containing patient documents, imaging archives, or exported records — a frequent precursor to healthcare data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
  selection_path:
    CommandLine|contains:
      - 'patients'
      - 'medical'
      - 'dicom'
      - 'pacs'
      - 'records'
      - 'exports'
  condition: selection_tool and selection_path
falsepositives:
  - Sanctioned archival of imaging or records by clinical IT — whitelist known paths and accounts
level: medium

// Bulk egress from database/web-tier hosts to uncommon external destinations
let lookback = 7d;
let rareDestThreshold = 3;
let suspiciousDests =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize ConnectionCount = count(), Devices = dcount(DeviceId) by RemoteUrl, RemoteIP
    | where Devices <= rareDestThreshold
    | project RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteIPType == "Public"
| where RemoteUrl has_any (suspiciousDests | project RemoteUrl) or RemoteIP in (suspiciousDests | project RemoteIP)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","java.exe","node.exe","sqlservr.exe","mysqld.exe","postgres.exe","curl.exe","rclone.exe","powershell.exe")
| summarize TotalConnections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Processes = make_set(InitiatingProcessFileName) by DeviceName, RemoteUrl, RemoteIP, RemotePort
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | summarize BytesSent = sum(tolong(InitiatingProcessFileName == InitiatingProcessFileName)) by DeviceName  // placeholder: replace with BytesSent field if your schema exposes it
  ) on DeviceName
| project DeviceName, RemoteUrl, RemoteIP, RemotePort, TotalConnections, Processes, FirstSeen, LastSeen
| order by TotalConnections desc

// Patient record enumeration via web/API logs (ingest portal/IIS/Apache logs via Syslog or Custom Logs)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("patient", "record", "dossier", "api/v")
| summarize Requests = count(), DistinctRecords = dcount(extract(@"(\d{4,})", 1, RequestURL)), DistinctURLs = dcount(RequestURL) by SourceIP, SourceUserID
| where DistinctRecords > 200 or Requests > 1000
| project SourceIP, SourceUserID, Requests, DistinctRecords, DistinctURLs
| order by DistinctRecords desc

-- Hunt for web/DB service child processes and staged archives on healthcare servers
LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(w3wp|httpd|nginx|java|tomcat|node|sqlservr|mysqld|postgres)'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM proc_hunt)
  AND Exe =~ '(?i)(rar|7z|7za|tar|curl|certutil|bitsadmin|rclone|powershell|cmd\.exe)'

LET staged_archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/**/Temp/*.zip',
                 'C:/Users/*/AppData/**/Temp/*.7z',
                 'C:/Users/*/AppData/**/Temp/*.rar',
                 'C:/Windows/Temp/*.zip',
                 'C:/Windows/Temp/*.7z',
                 'C:/ProgramData/**/*.rar',
                 'C:/inetpub/**/*.zip',
                 'C:/inetpub/**/*.7z'])
WHERE Size > 50000000
  AND Mtime > now() - 604800

SELECT * FROM suspicious_children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'STAGED_ARCHIVE' AS Name, FullPath AS Exe,
       'Size=' + format(format='%d', args=Size) AS CommandLine, NULL AS Username,
       Mtime AS CreateTime
FROM staged_archives

# Healthcare data-host hardening audit — review findings before remediating
# Run elevated. Outputs a report; does NOT change config unless you uncomment the enforcement sections.

$report = @()

# 1. Check for internet-facing listeners on sensitive ports (patient portal, DB, RDP, SMB)
$listeners = Get-NetTCPConnection -State Listen | Where-Object {
    $_.LocalAddress -eq '0.0.0.0' -and $_.LocalPort -in 80,443,1433,3306,5432,3389,445
} | Select-Object LocalPort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
$report += "=== Internet-reachable listeners (verify each is intended & fronted by WAF/VPN) ==="
$report += $listeners | Format-Table -AutoSize | Out-String

# 2. Verify advanced audit policy for sensitive data access (Object Access / File System)
$audit = auditpol /get /subcategory:"File System" 2>$null
$report += "=== Object Access auditing (must be Success+Failure on data dirs) ==="
$report += $audit | Out-String

# 3. Enumerate SACLs on likely patient-data directories
$dataDirs = @('D:\PatientData','D:\Exports','C:\inetpub\wwwroot\uploads','D:\DICOM','D:\PACS')
foreach ($dir in $dataDirs) {
    if (Test-Path $dir) {
        $acl = Get-Acl $dir
        $report += "=== ACL/SACL: $dir ==="
        $report += ($acl.Access | Select-Object IdentityReference, FileSystemRights, AccessControlType | Format-Table -AutoSize | Out-String)
        if (-not $acl.GetAuditRules($true,$false,'Everyone')) {
            $report += "[FINDING] No audit rules on $dir — add SACL for Everyone: Read/Modify/Delete (Success+Failure)"
        }
    }
}

# 4. Check SQL Server for weak auth posture (if installed)
$sqlSvc = Get-Service -Name 'MSSQL*' -ErrorAction SilentlyContinue | Where-Object Status -eq 'Running'
if ($sqlSvc) {
    $report += "=== SQL Server present — verify: mixed-mode auth disabled where possible, xp_cmdshell disabled, TLS enforced, no sa app-logins ==="
}

# 5. Check for endpoint/web egress controls
$fwRules = Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True -ErrorAction SilentlyContinue |
    Where-Object { $_.Profile -match 'Any|Domain' } | Measure-Object
$report += "=== Outbound allow rules (broad egress = easy exfiltration): $($fwRules.Count) ==="
$report += "Recommendation: default-deny outbound on DB/app tiers; permit only required destinations."

$report | Out-File "C:\Windows\Temp\HealthcareHostAudit_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Host $report

# Audit listeners, egress, and auditd coverage on healthcare app/DB hosts
# Listeners bound to all interfaces on sensitive ports
ss -tlnp | grep -E ':(80|443|3306|5432|6379|27017|111|2049)\b'

# Identify processes with outbound connections to rare destinations
ss -tnp state established | awk '{print $4, $5}' | sort | uniq -c | sort -rn | head -40

# Verify auditd watches on patient data paths (adjust paths to your deployment)
auditctl -l | grep -E '(patient|dicom|pacs|exports|records)'
# Add watches if missing:
auditctl -w /srv/patientdata -p rwxa -k patient_data_access
auditctl -w /var/www/portal/uploads -p rwxa -k patient_data_access

# Confirm DB services are NOT internet-reachable — bind check
ss -tlnp | grep -E 'mysql|postgres' | grep '0.0.0.0'

# Review retention: find stale exports older than 90 days (data minimization)
find /srv/exports /var/www/portal/uploads -type f -mtime +90 -ls 2>/dev/null