Defending Healthcare Systems: Detecting and Responding to Data Extortion Threats

---
title: Suspicious Large Database Export Activity
id: 8c2d7f4a-3e19-4b8c-9f1a-6d5e8c7f9a1b
status: experimental
description: Detects suspicious database export commands potentially indicating data exfiltration
references:
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\exp.exe'
    CommandLine|contains:
      - 'OUTFILE'
      - '-outfile'
      - '-output'
      - '--file'
  condition: selection
falsepositives:
  - Legitimate database backups by authorized personnel
  - Scheduled maintenance tasks
level: medium
---
title: Suspicious Data Archiving Patterns
id: 9a3e8f5b-4f2a-5c9d-0a2b-7e6f9d0a1b2c
status: experimental
description: Detects creation of compressed archives containing potentially sensitive data
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1560
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - '.zip'
      - '.7z'
      - '.rar'
    CommandLine|contains:
      - 'patient'
      - 'phi'
      - 'medical'
      - 'health'
      - 'record'
  condition: selection
falsepositives:
  - Legitimate administrative tasks
  - Authorized data archiving
level: high
---
title: Unusual Data Transfer to External Services
id: 0b4f9g6c-5g3b-6d0e-1b3c-8f7g0e1b2c3d
status: experimental
description: Detects large or frequent data transfers to external storage services
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'mega.nz'
      - 'dropbox.com'
      - 'drive.google.com'
      - 'onedrive.live.com'
      - 'pcloud.com'
      - 'mediafire.com'
    Initiated: 'true'
  filter:
    DestinationHostname|contains:
      - '.abbott.com'
      - '.healthcare.local'
  condition: selection and not filter
falsepositives:
  - Legitimate use of cloud storage services
  - Approved backup destinations
level: medium

// Detect suspicious database export activities
let DatabaseExportEvents = materialize (
  DeviceProcessEvents 
  | where Timestamp > ago(1d)
  | where FileName in~ ("mysqldump.exe", "pg_dump.exe", "sqlcmd.exe", "bcp.exe", "exp.exe")
  | where ProcessCommandLine has_any ("OUTFILE", "-outfile", "-output", "--file", "--result-file")
);
DatabaseExportEvents
| join kind=leftsemi (
  IdentityInfo
  | where AccountType == "Guest" or IsAccountEnabled == false or JobTitle !has "Admin"
) on AccountName
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, AccountUpn
| sort by Timestamp desc

// Detect large data transfers to external endpoints
DeviceNetworkEvents
| where Timestamp > ago(12h)
| where RemoteUrl has_any ("mega.nz", "dropbox.com", "drive.google.com", "onedrive.live.com", "pcloud.com")
| where SentBytes > 100000000 // Greater than 100MB
| summarize TotalBytes=sum(SentBytes), Count=count() by DeviceName, RemoteUrl, AccountName, bin(Timestamp, 1h)
| where TotalBytes > 500000000 or Count > 5
| project DeviceName, RemoteUrl, TotalBytes, Count, AccountName, TimeWindow
| sort by TotalBytes desc

// Detect creation of large archives in unusual locations
DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar"
| where FileSize > 50000000 // Greater than 50MB
| where FolderPath !contains @"\Program Files" 
  and FolderPath !contains @"\Windows" 
  and FolderPath !contains @"\ProgramData"
| project Timestamp, DeviceName, FileName, FileSize, FolderPath, InitiatingProcessAccountName
| sort by FileSize desc

-- Hunt for database export processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "mysqldump" 
   OR Name =~ "pg_dump" 
   OR Name =~ "sqlcmd" 
   OR Name =~ "bcp"
   OR Name =~ "exp"

-- Hunt for recent creation of large archive files
SELECT FullPath, Size, Mtime, Mode.String as Mode, Username
FROM glob(globs="/*/*.zip", root="/")
WHERE Size > 50000000
  AND Mtime > now() - 24h

-- Hunt for network connections to cloud storage endpoints
SELECT RemoteAddress, RemotePort, ProcessName, Pid, StartTime
FROM netstat()
WHERE RemoteAddress IN ("mega.nz", "dropbox.com", "drive.google.com", "onedrive.live.com")
  AND StartTime > now() - 24h

# Script to audit and harden database export permissions
function Audit-DatabaseExportPermissions {
    param(
        [string]$LogPath = "C:\Logs\DatabaseExportAudit.log"
    )
    
    # Create log directory if it doesn't exist
    $logDir = Split-Path $LogPath
    if (-not (Test-Path $logDir)) {
        New-Item -ItemType Directory -Path $logDir -Force | Out-Null
    }
    
    # Check for recent database export processes
    Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - Beginning database export permission audit" | Out-File -FilePath $LogPath -Append
    
    $exportProcesses = @("mysqldump", "pg_dump", "sqlcmd", "bcp", "exp")
    $suspiciousActivity = @()
    
    foreach ($proc in $exportProcesses) {
        $processes = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -ErrorAction SilentlyContinue |
                     Where-Object { $_.Message -match $proc } |
                     Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) }
        
        if ($processes) {
            foreach ($event in $processes) {
                $subject = $event.Message | Select-String "Subject:" -Context 0,2
                $commandLine = $event.Message | Select-String "Command Line:" -Context 0,0
                
                $suspiciousActivity += [PSCustomObject]@{
                    TimeStamp = $event.TimeCreated
                    ProcessName = $proc
                    Subject = $subject
                    CommandLine = $commandLine
                }
            }
        }
    }
    
    if ($suspiciousActivity.Count -gt 0) {
        Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - Found $($suspiciousActivity.Count) suspicious database export activities" | Out-File -FilePath $LogPath -Append
        $suspiciousActivity | Format-List | Out-File -FilePath $LogPath -Append
    } else {
        Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - No suspicious database export activities detected" | Out-File -FilePath $LogPath -Append
    }
    
    # Audit file share permissions for PHI
    $phiShares = Get-SmbShare | Where-Object { $_.Description -match "patient|medical|PHI|health" -or $_.Name -match "patient|medical|PHI|health" }
    
    foreach ($share in $phiShares) {
        $path = $share.Path
        $acl = Get-Acl -Path $path
        
        Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - Auditing share: $($share.Name)" | Out-File -FilePath $LogPath -Append
        
        foreach ($access in $acl.Access) {
            if ($access.IdentityReference -notmatch "SYSTEM|Administrators|Domain Admins|Authenticated Users" -and $access.IdentityReference -notmatch "^S-") {
                Write-Output "  Non-standard permission: $($access.IdentityReference) - $($access.FileSystemRights)" | Out-File -FilePath $LogPath -Append
            }
        }
    }
    
    Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - Audit complete" | Out-File -FilePath $LogPath -Append
    
    return $suspiciousActivity.Count
}

# Execute the audit
$result = Audit-DatabaseExportPermissions

# Create a report of findings
if ($result -gt 0) {
    Write-Host "CRITICAL: Found $result suspicious activities requiring investigation. Details logged."
    exit 1
} else {
    Write-Host "No suspicious activities detected. Continue monitoring."
    exit 0
}