Florida Retina Center Data Breach: Defending Against Unauthorized Access to PHI

---
title: Potential Mass Data Access or Staging via Archive Tools
id: 8a2f1c92-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects processes often used for data staging or archiving (e.g., 7-Zip, WinRAR) interacting with directories likely containing patient data or PHI.
references:
 - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.collection
 - attack.t1560.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\7z.exe'
     - '\winrar.exe'
     - '\tar.exe'
   CommandLine|contains:
     - 'a '  
     - '-compress'
     - '-c'
 condition: selection
falsepositives:
 - Legitimate backup operations by IT staff
level: high
---
title: Suspicious Remote Access Tool Execution
id: 9b3f1c82-9e4b-4d67-bc12-3e5a8f901235
status: experimental
description: Detects execution of common remote management tools (e.g., AnyDesk, TeamViewer, Splashtop) which are frequently used by adversaries for persistence and unauthorized access.
references:
 - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.command_and_control
 - attack.t1219
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|contains:
     - '\anydesk.exe'
     - '\teamviewer.exe'
     - '\splashtop.exe'
     - '\supremo.exe'
 condition: selection
falsepositives:
 - Authorized remote support sessions
level: medium
---
title: Unusual Access to Sensitive User Profile Directories
id: 0c4f1c82-9e4b-4d67-bc12-3e5a8f901236
status: experimental
description: Detects processes accessing sensitive user profile directories (Documents, Desktop) which may contain PHI exports or sensitive files, triggered by non-standard applications.
references:
 - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.collection
 - attack.t1005
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   CommandLine|contains:
     - '\Documents\'
     - '\Desktop\'
   Image|notcontains:
     - '\explorer.exe'
     - '\Microsoft.Office.\'
     - '\chrome.exe'
     - '\edge.exe'
 condition: selection
falsepositives:
 - User opening files with custom viewers
level: low

let HighValueAssets = DeviceProcessEvents
| where DeviceName has "Server" or DeviceName has "EHR" or DeviceName has "PACS"
| distinct DeviceName;
SigninLogs
| where ResultType == 0
| where isnotnull(IPAddress)
| where UserType in ("Member", "Guest")
| where DeviceDetail in (HighValueAssets) or AppDisplayName in ("Microsoft Office 365", "Electronic Health Record")
| join kind=anti (
    SigninLogs
    | where ResultType == 0
    | where Timestamp > ago(30d)
    | distinct IPAddress
) on IPAddress
| project Timestamp, UserPrincipalName, IPAddress, AppDisplayName, Location, DeviceDetail
| order by Timestamp desc

-- Hunt for unusual network connections from non-browser processes
SELECT Pid, Name, CommandLine, RemoteAddress, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND Name NOT IN ('chrome.exe', 'msedge.exe', 'firefox.exe', 'svchost.exe', 'lsass.exe', 'system')
  AND RemoteAddress NOT IN ('127.0.0.1', '::1', '0.0.0.0')
  AND RemotePort NOT IN (80, 443, 123)

# Audit Local Administrators for Unauthorized Access
function Invoke-AdminAudit {
    $AdminGroup = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
    $SuspiciousAccounts = @()

    foreach ($Member in $AdminGroup) {
        # Check for non-standard accounts (e.g., not Administrator, Domain Admins)
        if ($Member.Name -notmatch "Administrator" -and $Member.Name -notmatch "Domain Admins") {
            $AccountInfo = Get-LocalUser -Name $Member.SID.Value -ErrorAction SilentlyContinue
            
            if ($AccountInfo) {
                # Flag if enabled and not recently logged in (potential dormant backdoor)
                if ($AccountInfo.Enabled -eq $true -and $AccountInfo.LastLogon -lt (Get-Date).AddDays(-90)) {
                    $SuspiciousAccounts += [PSCustomObject]@{
                        AccountName = $Member.Name
                        SID = $Member.SID.Value
                        LastLogon = $AccountInfo.LastLogon
                        Status = "Enabled / Dormant"
                    }
                }
            }
        }
    }

    if ($SuspiciousAccounts.Count -gt 0) {
        Write-Host "[ALERT] Suspicious or dormant administrator accounts found:" -ForegroundColor Red
        $SuspiciousAccounts | Format-Table -AutoSize
    } else {
        Write-Host "[INFO] No suspicious dormant administrator accounts detected." -ForegroundColor Green
    }
}

Invoke-AdminAudit