DentaQuest Data Breach: Protecting Healthcare PHI Against Large-Scale Intrusions

---
title: Suspicious Mass File Transfer from Database Server
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential data exfiltration from database servers through unusual file transfer activities
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sqlservr.exe'
      - '\mysqld.exe'
      - '\postgres.exe'
    CommandLine|contains:
      - 'bcp'
      - 'sqlcmd'
      - 'mysqldump'
      - 'pg_dump'
      - 'export'
  condition: selection | count(CommandLine) > 10
falsepositives:
  - Legitimate database administrative tasks
  - Scheduled database backups
level: high
---
title: Unusual Database Connection from External IP
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects direct remote database connections from unusual geographic locations or non-business hours
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 1433
      - 3306
      - 5432
      - 1521
    Initiated: 'true'
  filter:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  timeframe: 24h
  condition: selection and not filter | count(SourceIp) > 5
falsepositives:
  - Legitimate remote administration
  - Business partners accessing database
level: high
---
title: Healthcare PHI Access Pattern Anomaly
id: 8a4e2d93-0f5c-4e7b-a9d6-2e6f9a0b1c23
status: experimental
description: Detects unusual access patterns to patient data indicating potential data exfiltration
references:
  - https://attack.mitre.org/techniques/T1115/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.collection
  - attack.t1115
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\patients\'
      - '\records\'
      - '\phi\'
      - '\protected_health_info\'
      - '\dental_records\'
  timeframe: 1h
  condition: selection | count(TargetFilename) > 100
falsepositives:
  - Legitimate bulk access by healthcare providers
  - System administrative tasks
level: high

// Detect potential data exfiltration from healthcare information systems
let TimeRange = 1h;
let DatabaseExfiltrationThreshold = 1000;
// Monitor for large data transfers from database servers
DeviceNetworkEvents
| where Timestamp > ago(TimeRange)
| where RemotePort in (1433, 3306, 5432, 1521) // Common database ports
| where InitiatingProcessVersionInfoCompanyName != "Microsoft Corporation"
| where SentBytes > DatabaseExfiltrationThreshold
| summarize TotalBytes = sum(SentBytes), ConnectionCount = count() by 
    DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl
| where TotalBytes > 10000000 // 10MB threshold
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, TotalBytes, ConnectionCount
| sort by TotalBytes desc

-- Hunt for processes potentially exfiltrating healthcare data
SELECT Pid, Name, Exe, CommandLine, Username,CreateTime
FROM pslist()
WHERE Name =~ 'sqlcmd.exe' 
   OR Name =~ 'bcp.exe'
   OR Name =~ 'mysqldump.exe'
   OR Name =~ 'pg_dump.exe'
   OR Name =~ 'sqlplus.exe'

-- Identify potential data staging areas
SELECT FullPath, Size, Mtime, Atime, Btime
FROM glob(globs='C:\\Temp\\*.{csv,txt,zip,sql,xlsx}')
WHERE Size > 1000000 AND Mtime > now() - 24h

# PowerShell script to secure healthcare database servers post-breach
# This script implements immediate hardening measures for PHI protection

# Enable advanced auditing for database access
function Enable-DatabaseAuditing {
    Write-Host "Configuring enhanced database auditing..."
    
    # Enable Object Access auditing
    $auditPolicy = auditpol /get /subcategory:"Object Access"
    if ($auditPolicy -notmatch "Success and Failure") {
        auditpol /set /subcategory:"Object Access" /success:enable /failure:enable
    }
    
    # Set PowerShell transcription for database administrators
    $transcriptPath = "C:\Logs\DatabaseAdminTranscripts"
    if (!(Test-Path $transcriptPath)) {
        New-Item -ItemType Directory -Path $transcriptPath -Force | Out-Null
    }
    Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 1 -ErrorAction SilentlyContinue
    Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "OutputDirectory" -Value $transcriptPath -ErrorAction SilentlyContinue
    
    Write-Host "Database auditing configuration completed."
}

# Block unauthorized database export tools
function Restrict-DataExportTools {
    Write-Host "Restricting access to data export tools..."
    
    # Block access to common data export tools
    $blockedTools = @(
        "bcp.exe",
        "sqlcmd.exe",
        "mysqldump.exe",
        "pg_dump.exe",
        "sqlldr.exe"
    )
    
    foreach ($tool in $blockedTools) {
        $toolPaths = Get-ChildItem -Path "C:\" -Filter $tool -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
        
        foreach ($path in $toolPaths) {
            $acl = Get-Acl -Path $path
            $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                "Everyone", 
                "ExecuteFile", 
                "None", 
                "None", 
                "Allow"
            )
            $acl.SetAccessRule($accessRule)
            Set-Acl -Path $path -AclObject $acl
        }
    }
    
    Write-Host "Data export tools restriction completed."
}

# Implement network isolation for database servers
function Isolate-DatabaseServers {
    Write-Host "Implementing network isolation for database servers..."
    
    # Create firewall rule to block direct database access from non-authorized subnets
    New-NetFirewallRule -DisplayName "Block Unauthorized Database Access" `
        -Direction Inbound `
        -Protocol TCP `
        -LocalPort 1433,3306,5432,1521 `
        -Action Block `
        -RemoteAddress "Internet" `
        -Profile Any `
        -Enabled True `
        -ErrorAction SilentlyContinue
    
    Write-Host "Network isolation configuration completed."
}

# Execute remediation functions
try {
    Enable-DatabaseAuditing
    Restrict-DataExportTools
    Isolate-DatabaseServers
    
    Write-Host "Database security hardening completed successfully." -ForegroundColor Green
}
catch {
    Write-Error "Error during security hardening: $_"
}