Healthcare AI Platform Illegal Patient Recording: Detection and Prevention Guide

---
title: Unauthorized Audio Capture Application Execution
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects execution of known audio capture/recording applications on clinical workstations outside approved hours or users.
references:
  - https://attack.mitre.org/techniques/T1123/
author: Security Arsenal
date: 2025/01/07
tags:
  - attack.collection
  - attack.t1123
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\\Audacity\\'
      - '\\obs-studio\\'
      - '\\ffmpeg.exe'
      - '\\vlc.exe'
      - '\\recorder.exe'
  filter_legitimate:
    ParentImage|contains:
      - '\\Program Files\\'
      - '\\Electronic Health Record\\'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate clinical dictation software
  - Authorized telehealth applications
level: medium
---
title: Excessive Outbound Traffic to AI/ML Platforms
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects sustained high-volume connections to known AI/ML service endpoints from clinical workstations.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2025/01/07
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_domains:
    DestinationHostname|contains:
      - '.openai.com'
      - '.anthropic.com'
      - '.googleapis.com'
      - '.amazonaws.com'
      - '.azure.com'
  selection_volume:
    Initiated|count: 10
    timeframe: 1h
  condition: selection_domains and selection_volume
falsepositives:
  - Legitimate use of approved AI clinical tools
  - Administrative testing
level: low
---
title: Microphone Access Activation on Clinical Workstations
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects activation of microphone capture capabilities on clinical workstations via Windows API calls.
references:
  - https://attack.mitre.org/techniques/T1123/
author: Security Arsenal
date: 2025/01/07
tags:
  - attack.collection
  - attack.t1123
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'Start-Process'
      - 'Device'
      - 'AudioCapture'
      - 'Microphone'
  filter_approved:
    Image|contains:
      - '\\TelehealthApp\\'
      - '\\ClinicalDictation\\'
      - '\\EHRSystem\\'
  condition: selection and not filter_approved
falsepositives:
  - Approved telehealth sessions
  - Dictation software
level: high

// Hunt for suspicious connections to AI/ML endpoints from clinical workstations
let aiEndpoints = dynamic([
    "openai.com", "anthropic.com", "googleapis.com", 
    "amazonaws.com", "azure.com", "huggingface.co"
]);
let clinicalWorkstations = DeviceProcessEvents
| where FileName has_any ("EHR", "Clinical", "Medical", "HealthRecord")
| distinct DeviceId;
DeviceNetworkEvents
| where DeviceId in (clinicalWorkstations)
| where RemoteUrl has_any (aiEndpoints)
| summarize Connections = count(), 
    FirstSeen = min(Timestamp), 
    LastSeen = max(Timestamp), 
    TotalBytes = sum(SentBytes + ReceivedBytes)
    by DeviceId, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName
| where Connections > 20
| order by Connections desc
| extend RiskScore = iff(Connections > 100, "High", iff(Connections > 50, "Medium", "Low"))
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName, Connections, TotalBytes, RiskScore

-- Hunt for processes with microphone/audio capture capabilities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "recorder" 
   OR Name =~ "ffmpeg" 
   OR Name =~ "audacity" 
   OR Name =~ "vlc"
   OR CommandLine =~ "-f dshow"
   OR CommandLine =~ "audio"
   OR CommandLine =~ "microphone"

-- Search for audio files in suspicious locations
SELECT FullPath, Size, Mtime, Atime, Btime
FROM glob(globs="*/AppData/Local/Temp/*.wav")
WHERE Size > 1024 * 1024  -- Files larger than 1MB
   OR Mtime > now() - 1h  -- Modified in the last hour

-- Identify active network connections to known AI endpoints
SELECT RemoteAddress, RemotePort, State, Pid, ProcessName
FROM netstat()
WHERE RemoteAddress =~ "13.64.232.140"  -- Example: OpenAI endpoint
   OR RemoteAddress =~ "44.224.22.12"   -- Example: Anthropic endpoint
   OR RemoteAddress =~ "172.217"        -- Google Cloud

# Audit AI/ML applications and microphone access on clinical workstations
# Run with administrative privileges

# Create audit report path
$auditPath = "C:\SecurityAudits\AI_Audio_"
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$reportFile = "$auditPath$timestamp.csv"

# Define authorized applications (customize for your environment)
$authorizedApps = @(
    "C:\Program Files\EHRSystem\EHR.exe",
    "C:\Program Files\TeleHealth\TeleHealthApp.exe",
    "C:\Program Files\ClinicalDictation\Dictate.exe"
)

# Function to check microphone access status
function Get-MicrophoneAccess {
    $privacyKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"
    $value = (Get-ItemProperty -Path $privacyKey -ErrorAction SilentlyContinue).Value
    return $value
}

# Function to get audio capture processes
function Get-AudioCaptureProcesses {
    $audioApps = @("audacity", "vlc", "ffmpeg", "obs", "recorder", "sound recorder", "windows audio capture")
    Get-Process | Where-Object { 
        $audioApps | Where-Object { $_.ProcessName -like "*$($_)*" }
    }
}

# Execute audit
Write-Host "Starting AI Audio Access Audit..." -ForegroundColor Cyan

$auditResults = @()

# Check microphone privacy settings
$micAccess = Get-MicrophoneAccess
$auditResults += [PSCustomObject]@{
    Check = "Microphone Privacy Setting"
    Status = if ($micAccess -eq "Allow") { "ENABLED" } else { $micAccess }
    Recommendation = if ($micAccess -eq "Deny") { "Review: Microphone access denied system-wide" } else { "Verify only authorized apps have access" }
}

# Get running audio capture applications
$audioProcesses = Get-AudioCaptureProcesses
if ($audioProcesses) {
    foreach ($proc in $audioProcesses) {
        $isAuthorized = $authorizedApps | Where-Object { $proc.Path -eq $_ }
        $auditResults += [PSCustomObject]@{
            Check = "Audio Capture Process"
            ProcessName = $proc.ProcessName
            Path = $proc.Path
            Status = if ($isAuthorized) { "AUTHORIZED" } else { "UNAUTHORIZED" }
            Recommendation = if ($isAuthorized) { "No action needed" } else { "Investigate and terminate if not clinical use" }
        }
    }
} else {
    $auditResults += [PSCustomObject]@{
        Check = "Audio Capture Processes"
        Status = "None detected"
        Recommendation = "Continue monitoring"
    }
}

# Check recent audio files in temp directories
$tempAudio = Get-ChildItem -Path $env:TEMP -Filter *.wav -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }

if ($tempAudio) {
    $auditResults += [PSCustomObject]@{
        Check = "Recent Audio Files in Temp"
        Status = "Found $($tempAudio.Count) files"
        Recommendation = "Review files for patient data; investigate origin"
    }
}

# Export results
$auditResults | Export-Csv -Path $reportFile -NoTypeInformation
Write-Host "Audit complete. Results saved to: $reportFile" -ForegroundColor Green

# Display summary
Write-Host "`n--- AUDIT SUMMARY ---" -ForegroundColor Yellow
$auditResults | Format-Table -AutoSize

# Automated remediation recommendations
Write-Host "`n--- REMEDIATION ACTIONS ---" -ForegroundColor Yellow

# Disable microphone for unauthorized processes (if any)
foreach ($proc in $audioProcesses) {
    $isAuthorized = $authorizedApps | Where-Object { $proc.Path -eq $_ }
    if (-not $isAuthorized -and $proc.Path) {
        Write-Host "Potentially unauthorized audio capture detected: $($proc.Path)" -ForegroundColor Red
        Write-Host "  Review process PID: $($proc.Id)" -ForegroundColor Red
    }
}

# Recommend policy enforcement
Write-Host "`nRecommended Policy Actions:" -ForegroundColor Cyan
Write-Host "1. Implement Device Guard/WDAC to block unauthorized audio apps"
Write-Host "2. Configure AppLocker to restrict execution of recording software"
Write-Host "3. Review and update Business Associate Agreements with AI vendors"
Write-Host "4. Conduct quarterly audits of AI tool data handling practices"