FulcrumSec Extortion Campaign: Defending Against Large-Scale Clinical Data Exfiltration

---
title: Potential Large Scale Data Staging via Compression
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects processes creating large archives or compressing data in user directories, indicative of data staging prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/06/16
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\winzip.exe'
      - '\tar.exe'
  selection_cli:
    CommandLine|contains:
      - '-a' # Archive flag
      - '-m0' # Compression method
      - '-tzip'
  selection_path:
    CommandLine|contains:
      - 'C:\Users\'
      - 'C:\ProgramData\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - Legitimate administrative backups
  - User compression of personal files
level: medium
---
title: High Volume Outbound Network Data Transfer
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects endpoints sending unusually high volumes of data (gigabytes) over short timeframes, indicative of large data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/06/16
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: true
    DestinationPort:
      - 443
      - 80
  filter:
    DestinationIp|contains:
      - '.microsoft.com'
      - '.google.com'
      - '.amazonaws.com'
      - '.novonordisk.com' # Internal trusted domains
  timeframe: 5m
  condition: selection and not filter | count() > 100 # Threshold: high packet count often correlates with data transfer; refine based on environment baselines for bytes sent if available
falsepositives:
  - Legitimate cloud backup uploads
  - Video conferencing traffic
level: high
---
title: Execution of Common Data Exfiltration Tools
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects execution of command-line tools often abused for data exfiltration, such as rclone or megacmd.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/16
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\scp.exe'
      - '\sftp.exe'
  condition: selection
falsepositives:
  - Administrator use of rclone for legitimate sync
level: high

// Hunt for high volume outbound data transfer from internal IPs to external destinations
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" 
| where RemotePort in (443, 80, 21, 22) 
| extend SentBytes = coalesce(SentBytes, 0) 
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, RemoteUrl, bin(Timestamp, 1h)
| where TotalBytesSent > 500000000 // Threshold: 500MB per hour
| order by TotalBytesSent desc
| project Timestamp, DeviceName, RemoteUrl, TotalBytesSent

-- Hunt for recently created large archive files often used for staging
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='''C:\Users\**\*.zip''', accessor='auto')
WHERE Size > 100000000 
  AND Mtime > now() - 7d
-- Also check for RAR and 7z
UNION SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='''C:\Users\**\*.7z''', accessor='auto')
WHERE Size > 100000000 
  AND Mtime > now() - 7d

# Security Arsenal - FulcrumSec Response Script
# Scans for common exfiltration binaries and suspicious large archives

Write-Host "[+] Starting hunt for FulcrumSec Indicators..." -ForegroundColor Cyan

# 1. Check for common exfiltration tools in user profiles
$ExfilTools = @("rclone.exe", "megacmd.exe", "winscp.exe", "filezilla.exe")
$PathsToScan = @("C:\Users\", "C:\ProgramData\", "$env:TEMP")

foreach ($Tool in $ExfilTools) {
    Write-Host "[!] Scanning for $Tool..." -ForegroundColor Yellow
    Get-ChildItem -Path $PathsToScan -Filter $Tool -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime, Length
}

# 2. Identify large archives created in the last 7 days (>500MB)
Write-Host "[!] Scanning for large archives created in last 7 days (>500MB)..." -ForegroundColor Yellow
$DateThreshold = (Get-Date).AddDays(-7)
Get-ChildItem -Path "C:\Users\" -Include *.zip, *.rar, *.7z -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 500MB -and $_.LastWriteTime -gt $DateThreshold } |
    Select-Object FullName, LastWriteTime, @{Name='SizeMB';Expression={[math]::Round($_.Length / 1MB, 2)}}

Write-Host "[+] Scan complete. Review findings for anomalies." -ForegroundColor Green