FTC/State Action on Him & Hers: Defending Against Unauthorized Telehealth Data Sharing

---
title: Potential Telehealth PHI Leakage to Marketing Domains
id: 8a4b2c1d-9e3f-4a5b-b6c7-1d2e3f4a5b6c
status: experimental
description: Detects outbound web traffic from telehealth applications to known advertising/analytics domains which may capture PHI without a BAA.
references:
  - https://www.ftc.gov/reports/ftc-staff-report-companies-use-and-disclosure-claims-consumer-health-information
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
    cs-host|contains:
      - 'facebook.com'
      - 'google-analytics.com'
      - 'doubleclick.net'
      - 'tiktok.com'
      - 'connect.facebook.net'
    cs-uri-query|contains:
      - 'email='
      - 'phone='
      - 'medication='
      - 'condition='
  condition: selection
falsepositives:
  - Legitimate marketing traffic authorized by BAA
level: high
---
title: High Volume Data Exfiltration to Non-Medical External Endpoints
id: 9c5d3e2f-0f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Identifies suspicious high-volume POST requests from internal web servers to unknown external IPs, characteristic of data syncing to CRM/Analytics clouds.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 443
    DestinationIp|startswith:
      - '0.0.0.0' # Placeholder for exclusion of internal CIDR
  filter:
    DestinationHostname|endswith:
      - '.hospital.local'
      - '.medical-domain.com'
  timeframe: 5m
  condition: selection | count() > 50 and not filter
falsepositives:
  - Legitimate high-traffic API calls to approved partners
level: medium

// Hunt for telehealth app traffic connecting to known high-risk tracking domains
let HighRiskDomains = dynamic(["facebook.com", "google-analytics.com", "doubleclick.net", "tiktok.com", "analytics.tiktok.com", "bat.bing.com"]);
DeviceNetworkEvents
| where InitiatingProcessFileName in~("chrome.exe", "firefox.exe", "msedge.exe", "safari.exe") 
| where RemoteUrl has_any (HighRiskDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RequestURL, SentBytes, ReceivedBytes
| order by Timestamp desc

-- Hunt for browser processes connecting to ad-tech domains from telehealth workstations
SELECT 
  Pid, 
  Name, 
  Username, 
  concat(Split(RemoteAddr, ":")[0]) as RemoteIP, 
  RemotePort 
FROM netstat() 
WHERE Name =~ "chrome" OR Name =~ "firefox" OR Name =~ "msedge"
  AND RemotePort IN (443, 80)
-- Regex to match common ad/tracking hostnames if resolved (requires DNS cache lookup or enrichment)

# Audit IIS Logs for Potential PHI Leakage to Third Parties
param(
    [string]$LogPath = "C:\inetpub\logs\LogFiles\",
    [string[]]SensitiveKeywords = @("email", "phone", "ssn", "condition", "prescription"),
    [string[]]BlockedDomains = @("facebook", "google-analytics", "doubleclick", "tiktok")
)

$LogFile = Get-ChildItem -Path $LogPath -Recurse -Filter "u_ex*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1

if ($LogFile) {
    Write-Host "Scanning recent log file: $($LogFile.FullName)"
    Select-String -Path $LogFile.FullName -Pattern $SensitiveKeywords | 
    Where-Object { 
        $BlockedDomains | Where-Object { $_ -and $_.Length -gt 0 } | ForEach-Object { 
            $_.toLower() 
        } | Where-Object { $_ -and $_.Length -gt 0 } | ForEach-Object { 
            $line = $_; if ($_.Line -match $line) { return $true } } 
    } | 
    ForEach-Object {
        $fields = $_.Line.Split(" ")
        [PSCustomObject]@{
            Date = $fields[0] + " " + $fields[1]
            IP = $fields[8]
            Method = $fields[3]
            UriStem = $fields[4]
            UriQuery = $fields[5]
            UserAgent = $fields[9]
            MatchedLine = $_.Line.Trim()
        }
    } | Export-Csv -Path "C:\Temp\PHI_Leak_Report.csv" -NoTypeInformation
    Write-Host "Scan complete. Results saved to C:\Temp\PHI_Leak_Report.csv"
} else {
    Write-Host "No log files found in $LogPath"
}