GrayRobinson Data Breach: Detecting and Containing Large-Scale PII Exfiltration

---
title: Potential Mass Data Staging via Archiving Tools
id: 8a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects the execution of file compression utilities often used to stage large amounts of PII/PHI before exfiltration. High volume or usage on servers is suspicious.
references:
 - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.collection
 - attack.t1560.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\winrar.exe'
     - '\7z.exe'
     - '\winzip.exe'
     - '\tar.exe'
   CommandLine|contains:
     - '-a'     # Add to archive
     - 'compress'
 condition: selection
falsepositives:
 - Legitimate administrative backups
 - User compressing their own folders
level: high
---
title: PowerShell Suspicious Web Request Activity
id: 9b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects PowerShell making web requests which is often used for exfiltration or C2 communications. Legitimate admin use is rare compared to malicious use.
references:
 - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.exfiltration
 - attack.t1071.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\powershell.exe'
     - '\pwsh.exe'
   CommandLine|contains:
     - 'Invoke-WebRequest'
     - 'IEX'
     - 'DownloadString'
   CommandLine|contains:
     - 'http'
 condition: selection
falsepositives:
 - System management scripts
 - Package managers
level: high

// Hunt for large volume file creation events consistent with archiving/staging
// Focus on file servers and high-volume directories
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".7z"
| where InitiatingProcessFileSize > 1000000 // Filter for larger processes to reduce noise, or remove for total visibility
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine
| summarize count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where count_ > 5 // Threshold for suspicious activity

-- Hunt for processes interacting with high numbers of files or handles
-- indicative of data crawling or mass encryption/staging
SELECT Pid, Name, CommandLine, Username, Handles, CreateTime
FROM pslist()
WHERE Handles > 500
   OR Name IN ('winrar.exe', '7zFM.exe', 'powershell.exe', 'wscript.exe')
   AND CommandLine =~ '(password|http|ftp|share|copy|move)'

# Audit and Identify Open Shares with Excessive Permissions (Common Vector for Data Theft)
# Requires Admin Privileges

Write-Host "[+] Auditing Active Directory File Shares for Excessive Access..." -ForegroundColor Cyan

$Shares = Get-SmbShare | Where-Object { $_.Type -eq '0' -and $_.Name -notlike '*$*' }

foreach ($Share in $Shares) {
    $Path = $Share.Path
    if (Test-Path $Path) {
        Write-Host "Analyzing Share: $($Share.Name) at $Path" -ForegroundColor Yellow
        
        # Get ACLs
        $Acl = Get-Acl -Path $Path
        
        foreach ($Access in $Acl.Access) {
            # Check for 'Everyone' or 'Authenticated Users' with Modify or FullControl
            if (($Access.IdentityReference.Value -eq 'Everyone' -or $Access.IdentityReference.Value -eq 'Authenticated Users') -and 
                ($Access.FileSystemRights -match 'Modify|FullControl')) {
                
                Write-Host "[!] CRITICAL: Excessive Permission Found" -ForegroundColor Red
                Write-Host "    Identity: $($Access.IdentityReference.Value)" -ForegroundColor Red
                Write-Host "    Rights: $($Access.FileSystemRights)" -ForegroundColor Red
                Write-Host "    Path: $Path" -ForegroundColor Red
            }
        }
    }
}
Write-Host "[+] Audit Complete." -ForegroundColor Green