Defending Cardiac Data: iRhythm Holdings Cyberattack and PHI Protection

---
title: Potential PHI Exfiltration via Archive Tools
id: 8a2b4c9d-1e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects the creation of archive files (zip, rar, 7z) on database servers or file shares containing patient data, which is a common method of data exfiltration.
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.exfiltration
  - attack.t1560
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\sql\\'
      - '\\database\\'
      - '\\patients\\'
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
  condition: selection
falsepositives:
  - Legitimate administrative backups
level: high
---
title: Suspicious PowerShell Encoded Command Execution
id: 9b3c5d0e-2f4a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects PowerShell usage with encoded commands, often used by attackers to obfuscate malware download or execution during the lateral movement phase.
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\powershell.exe'
    CommandLine|contains:
      - ' -EncodedCommand '
      - ' -Enc '
  condition: selection
falsepositives:
  - Legitimate system management scripts
level: medium
---
title: Remote Access Tool on Database Server
id: 0c4d6e1f-3g5b-6c7d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects the execution of common remote access tools (TeamViewer, AnyDesk, RDP wrapper) on systems typically designated as database or application servers.
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\teamviewer.exe'
      - '\\anydesk.exe'
      - '\\mstsc.exe'
  filter:
    SubjectLogonId: '0x3e7' # Filter out SYSTEM logons if necessary, though rare for these apps
  condition: selection
falsepositives:
  - Authorized remote administration
level: high

// Hunt for massive data transfers or access to sensitive file shares
// Focus on unusual outbound network traffic from known database servers
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType in ("ConnectionAccepted", "ConnectionSuccess")
| where InitiatingProcessFileName in~ ("sqlservr.exe", "mysqld.exe", "postgres.exe")
| where RemotePort != 443 and RemotePort != 80 // Exclude standard web traffic initially
| summarize Count=count(), DistinctIPs=dcount(RemoteIP) by DeviceName, RemoteIP
| where Count > 1000 // Threshold for high connection volume
| project DeviceName, RemoteIP, Count, DistinctIPs
| extend AlertMessage = "High volume network traffic detected from database server"

-- Hunt for recently created compressed files or executables in user directories
-- which may indicate data staging or payload deployment
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="C:\Users\*\*.zip")
WHERE Mtime > now() - 7d
  AND Size > 1024 * 1024 -- Larger than 1MB

UNION

-- Hunt for unexpected executables in AppData/Temp
SELECT FullPath, Size, Mtime
FROM glob(globs="C:\Users\*\AppData\Local\Temp\*.exe")
WHERE Mtime > now() - 2d

# PowerShell Script: Audit PHI Directory Access and Identify Unusual User Permissions
# Requires Active Directory module and appropriate administrative rights

Write-Host "Starting PHI Access Audit..." -ForegroundColor Cyan

# Define sensitive paths (Adjust these to match your environment)
$sensitivePaths = @(
    "D:\PatientData",
    "C:\inetpub\wwwroot\Data",
    "\\FileServer01\PHI"
)

foreach ($path in $sensitivePaths) {
    if (Test-Path $path) {
        Write-Host "Checking access for: $path" -ForegroundColor Yellow
        try {
            $acl = Get-Acl -Path $path
            foreach ($access in $acl.Access) {
                # Flag non-inherited write/modify access for non-admin groups
                if (-not $access.IsInherited -and $access.FileSystemRights -match "Write|Modify|FullControl") {
                    Write-Host "[ALERT] Explicit Write Access Found: $($access.IdentityReference) has $($access.FileSystemRights) on $path" -ForegroundColor Red
                }
            }
        }
        catch {
            Write-Host "Error accessing ACLs for $path : $_" -ForegroundColor DarkRed
        }
    }
    else {
        Write-Host "Path not found: $path" -ForegroundColor DarkGray
    }
}

Write-Host "Audit complete. Review highlighted permissions." -ForegroundColor Green