Defending Against Large-Scale Healthcare Data Breaches: Lessons from Nacogdoches Memorial

---
title: Potential Data Staging via Archive Tools
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of common archiving tools (7-Zip, WinRAR) often used to compress and stage sensitive data for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\7z.exe'
      - '\winrar.exe'
      - '\zip.exe'
    CommandLine|contains:
      - '-a'
      - '-m'
      - '.zip'
      - '.rar'
      - '.7z'
  condition: selection
falsepositives:
  - Legitimate administrative backup tasks
level: medium
---
title: Suspicious Access to Sensitive Directories
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects processes accessing common paths often used to store databases or backups in healthcare environments.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Patients\'
      - '\EHR\'
      - '\MedicalRecords\'
      - '\Backups\'
      - '\Database\'
  condition: selection
falsepositives:
  - Authorized backup software
  - EHR system maintenance
level: high

// Hunt for mass file copying or compression activities potentially indicating exfiltration
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith_cs ".zip" or FileName endswith_cs ".rar" or FileName endswith_cs ".7z"
| where InitiatingProcessFileName !in ~("explorer.exe", "svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, FileName
| order by Timestamp desc


// Identify unusual sign-ins from unfamiliar locations to sensitive applications
SigninLogs
| where Result == 0
| where AppDisplayName has_any ("Epic", "Cerner", "Meditech", " PHI")
| extend Location = strcat(City, ",", State)
| where isnotcustom(Location)
| project TimeGenerated, UserPrincipalName, AppDisplayName, Location, DeviceDetail, ConditionalAccessStatus
| order by TimeGenerated desc

-- Hunt for recent archive files (zip, rar, 7z) created in the last 7 days
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/*.zip', globs='/**/*.rar', globs='/**/*.7z')
WHERE Mtime > now() - 7D
  AND NOT FullPath =~ 'C:\Windows\'
  AND NOT FullPath =~ 'C:\Program Files\'

-- Hunt for processes accessing sensitive patient data directories
SELECT Name, Pid, StartTime, CommandLine, Exe
FROM pslist()
WHERE Exe =~ 'cmd.exe' OR Exe =~ 'powershell.exe' OR Exe =~ 'pwsh.exe'
  AND CommandLine =~ '(\Patients|\MedicalRecords|\Database)'

<#
.SYNOPSIS
    Audit for Unauthorized Access to Sensitive Shares.
.DESCRIPTION
    This script checks for unusual permission assignments on folders containing sensitive data.
#>

$SensitivePaths = @("C:\Data\Patients", "D\MedicalRecords", "\EHR-Server\DB")

foreach ($Path in $SensitivePaths) {
    if (Test-Path $Path) {
        Write-Host "Auditing Permissions for: $Path" -ForegroundColor Cyan
        $Acl = Get-Acl -Path $Path
        foreach ($Access in $Acl.Access) {
            # Check for non-standard or excessive permissions
            if ($Access.FileSystemRights -match "FullControl|Modify" -and $Access.IdentityReference -notmatch "BUILTIN|NT AUTHORITY\SYSTEM|Domain Admins") {
                Write-Host "[!] Potential excessive permission found:" -ForegroundColor Red
                Write-Host "    User: $($Access.IdentityReference)"
                Write-Host "    Rights: $($Access.FileSystemRights)"
            }
        }
    }
}