Defending Healthcare Data: Strategies to Prevent Breaches Like CareCloud

---
title: Potential Sensitive Database File Access
id: 7f9b8e1a-3d4f-4a5c-9b1e-2f3a4b5c6d7e
status: experimental
description: Detects access or modification of common healthcare database file extensions (e.g., .bak, .sql, .mdf) which may indicate data exfiltration preparation.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.bak'
      - '.sql'
      - '.mdf'
      - '.ldf'
      - '.db'
  condition: selection
falsepositives:
  - Legitimate database administrative backups
level: medium
---
title: Suspicious Rclone Execution for Data Exfiltration
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of rclone, a command-line tool often abused by threat actors to exfiltrate large amounts of data to cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
  condition: selection
falsepositives:
  - Authorized administrator use of rclone for backups
level: high
---
title: PowerShell Suspicious Encoded Command
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell usage with encoded commands, often used to obfuscate malicious scripts or ransomware payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
  condition: selection
falsepositives:
  - Legitimate software deployment scripts using encoding
level: high

// Detect large outbound data transfers indicative of exfiltration
DeviceNetworkEvents
| where ActionType == "ConnectionAllowed"
| where RemotePort in (443, 80, 21)
| where SentBytes > 50000000 // Threshold: 50MB
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, SentBytes
| order by Timestamp desc


// Identify processes accessing sensitive file paths often associated with EHR data
DeviceFileEvents
| where InitiatingProcessFileName !in ("sqlservr.exe", "mysqld.exe", "postgres.exe") // Exclude known DB engines
| where TargetFilePath has_any ("Patients", "Medical", "PHI", "EHR", ".bak", ".sql")
| project Timestamp, DeviceName, InitiatingProcessFileName, TargetFilePath, ActionType
| order by Timestamp desc

-- Hunt for recently created archives in user directories which may contain staged data
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='C:/Users/*/*.zip', globs='C:/Users/*/*.rar', globs='C:/Users/*/*.7z')
WHERE Mtime > now() - 7d
  AND Size > 1000000


-- Hunt for suspicious process command lines containing database export keywords
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ 'mysqldump'
   OR CommandLine =~ 'pg_dump'
   OR CommandLine =~ 'bcp '
   OR CommandLine =~ 'sqlcmd'

<#
.SYNOPSIS
    Audit File Share Permissions for Sensitive Data.
.DESCRIPTION
    This script checks for open permissions on shares that might contain patient data.
#>

$SensitiveKeywords = @("Patient", "Medical", "Records", "PHI", "EHR")
$Shares = Get-SmbShare | Where-Object { $_.Path -ne $null -and $_.Special -eq $false }

foreach ($Share in $Shares) {
    $Path = $Share.Path
    if ($SensitiveKeywords | Where-Object { $Path -like "*$_*" }) {
        Write-Host "Checking permissions on sensitive share: $($Share.Name) at $Path" -ForegroundColor Cyan
        $Acl = Get-Acl -Path $Path
        foreach ($Access in $Acl.Access) {
            if ($Access.IdentityReference -notmatch "^(NT AUTHORITY\SYSTEM|BUILTIN\Administrators|DOMAIN\Domain Admins)") {
                if ($Access.FileSystemRights -match "Write|Modify|FullControl") {
                    Write-Host "ALERT: Excessive permissions found for $($Access.IdentityReference) with rights $($Access.FileSystemRights)" -ForegroundColor Red
                }
            }
        }
    }
}