HCCI Data Breach: Historic Social Engineering Attack Exposes PHI — Defense Guide

---
title: Suspicious PowerShell Encoded Command Pattern
id: 89a3a451-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects base64 encoded commands often used in phishing follow-on reconnaissance and payload execution.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/07/18
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' -e '
      - ' -enc '
      - ' -encodedcommand '
  condition: selection
falsepositives:
  - Legitimate administrative scripts utilizing encoding
level: high
---
title: Office Application Spawning Shell
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects Microsoft Office apps spawning cmd or powershell, a common indicator of macro-based phishing payloads.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/07/18
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate document automation workflows
level: high
---
title: Potential Data Staging Mass Copy
id: 12b4c567-89d0-12e3-a456-426614174000
status: experimental
description: Detects mass copying of files (more than 20 in a short window) often associated with data exfiltration staging.
references:
  - https://attack.mitre.org/techniques/T1074/
author: Security Arsenal
date: 2026/07/18
tags:
  - attack.collection
  - attack.t1074.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\robocopy.exe'
      - '\xcopy.exe'
    CommandLine|contains:
      - 'copy '
      - 'xcopy '
      - 'robocopy '
  filter:
    TargetFileName|contains:
      - '\AppData\Local\Temp'
      - '\Windows\Temp'
  condition: selection and not filter
falsepositives:
  - System backups or administrative file migrations
level: medium

let TimeFrame = 1h;
let FileThreshold = 50;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessAccountName != "System"
| where ActionType == "FileCreated" or ActionType == "FileAccessed"
| summarize FileCount = dcount(FileName), make_list(FileName) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where FileCount >= FileThreshold
| project DeviceName, UserAccount=InitiatingProcessAccountName, FileCount, AccessedFiles=FileList_Column1, TimeWindow

-- Hunt for suspicious child processes of email or browser clients
SELECT Parent.Name AS ParentName, Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ '(outlook.exe|teams.exe|chrome.exe|msedge.exe|firefox.exe)'
   AND (Name =~ '(powershell.exe|cmd.exe|wscript.exe|cscript.exe)' 
        OR CommandLine =~ '(Invoke-Expression|IEX |DownloadString)')

# Audit Exchange Online for suspicious Inbox Forwarding Rules
# Requires Exchange Online Management Module (Connect-ExchangeOnline)

Write-Host "Auditing mailboxes for external forwarding rules..." -ForegroundColor Cyan

$mailboxes = Get-Mailbox -ResultSize Unlimited

foreach ($mailbox in $mailboxes) {
    $rules = Get-InboxRule -Mailbox $mailbox.Identity | Where-Object { $_.ForwardTo -ne $null -or $_.RedirectTo -ne $null }
    
    if ($rules) {
        Write-Host "[!] Potential Forwarding Rule Found in: $($mailbox.PrimarySmtpAddress)" -ForegroundColor Red
        foreach ($rule in $rules) {
            Write-Host "    Rule Name: $($rule.Name)" -ForegroundColor Yellow
            Write-Host "    Enabled: $($rule.Enabled)"
            Write-Host "    Forward To: $($rule.ForwardTo)"
            Write-Host "    Redirect To: $($rule.RedirectTo)"
        }
    }
}

Write-Host "Audit complete." -ForegroundColor Green