Healthcare Data Breach Settlements: Vida Y Salud and Hampton Regional Medical Center — What Defenders Must Do Now

---
title: Suspicious Access to Email Export or PST Archive Activity
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects process execution patterns associated with bulk email export or archive creation, commonly observed in healthcare breaches where attackers harvest PHI from compromised email accounts. Attackers frequently export mailbox contents to PST files for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_cli:
    CommandLine|contains:
      - 'New-MailboxExportRequest'
      - 'Export-Mailbox'
      - '.pst'
      - 'Search-Mailbox'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate Exchange administrator mailbox export operations
  - Compliance-driven eDiscovery exports
level: high
---
title: Abnormal Volume Access to PHI Database or File Shares
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects abnormal patterns of access to file shares or database servers known to contain PHI. In healthcare breaches, attackers frequently stage bulk data from file servers and database systems before exfiltration. This rule identifies process-level access to common database files and archive creation on servers.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '7z.exe a '
      - 'rar.exe a '
      - 'Compress-Archive'
      - 'tar.exe -c'
  selection_paths:
    CommandLine|contains:
      - 'Patients'
      - 'PHI'
      - 'MedicalRecords'
      - 'EHR'
      - 'EMR'
      - 'PatientData'
  condition: selection and selection_paths
falsepositives:
  - Legitimate backup operations using compression tools
  - IT administrative archiving of patient data for migration
level: high
---
title: VPN Authentication from Anomalous Geographic Location
id: c3d4e5f6-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects successful VPN or remote access authentication from geographic locations inconsistent with the user's established patterns. In healthcare breaches, compromised credentials are frequently used from foreign IP addresses to access remote access portals and VPN concentrators.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1078
  - attack.initial_access
  - attack.t1133
logsource:
  category: authentication
  product: windows
  service: vpn
detection:
  selection:
    AuthenticationResult: 'success'
    SourceCountry|contains:
      - 'Russia'
      - 'North Korea'
      - 'Iran'
      - 'China'
      - 'Nigeria'
  filter_us_based_org:
    OrganizationCountry: 'US'
  condition: selection and filter_us_based_org
falsepositives:
  - Traveling executives using VPN from international locations
  - Third-party vendors with offshore support teams
level: high

// Hunt for anomalous mailbox access and bulk file download patterns indicative of PHI harvesting
// Deploy in Sentinel as a scheduled analytics rule with 6-hour lookback
let lookback = 6h;
let threshold_download_count = 50;
// Detect abnormal mailbox operations — search, export, or bulk read
let SuspiciousMailboxActivity =
    OfficeActivity
    | where TimeGenerated > ago(lookback)
    | where OfficeWorkload == "Exchange"
    | where Operation in ("SearchQueryInitiatedExchange", "MailboxLogin", "New-InboxRule", "Set-InboxRule")
    | where UserId !contains "health.local" // exclude known service accounts
    | summarize
        OperationCount = count(),
        Operations = make_set(Operation),
        SourceIPs = make_set(ClientIP)
        by UserId, bin(TimeGenerated, 1h)
    | where OperationCount > 20;
// Detect abnormal file access on servers hosting PHI shares
let SuspiciousFileActivity =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4663 // Object access attempt
    | where ObjectName has_any ("Patients", "PHI", "MedicalRecords", "EHR", "EMR", "PatientData", "Clinical")
    | where AccessMask has_any ("0x2", "0x4") // WriteData or ReadData
    | summarize
        FileAccessCount = count(),
        DistinctFiles = dcount(ObjectName),
        AccessedFiles = make_set(ObjectName, 10)
        by SubjectAccount, IpAddress, bin(TimeGenerated, 1h)
    | where DistinctFiles > threshold_download_count;
// Correlate both signals — accounts showing both suspicious mail and file activity
SuspiciousMailboxActivity
| join kind=inner (SuspiciousFileActivity) on $left.UserId == $right.SubjectAccount
| project
    TimeGenerated,
    UserId,
    OperationCount,
    Operations,
    SourceIPs,
    FileAccessCount,
    DistinctFiles,
    AccessedFiles
| extend RiskScore = OperationCount + DistinctFiles
| sort by RiskScore desc

// Hunt for processes accessing PHI directories at abnormal volume
// Designed for Defender for Endpoint with file share audit policies enabled
let lookback = 24h;
let phi_paths = dynamic(["Patients", "PHI", "MedicalRecords", "EHR", "EMR", "PatientData", "Clinical", "HIPAA"]);
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has_any (phi_paths)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessAccountName !in~ ("system", "network service", "local service")
| summarize
    FileOperations = count(),
    DistinctFiles = dcount(FileName),
    Processes = make_set(InitiatingProcessFileName),
    FileNames = make_set(FileName, 10)
    by InitiatingProcessAccountName, DeviceName, bin(TimeGenerated, 1h)
| where DistinctFiles > 30
| sort by DistinctFiles desc

-- Hunt for bulk archive creation and PHI staging on Windows file servers
-- Deploy as a Velociraptor hunt across all servers hosting PHI shares

SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    parent_process_name() as ParentProcess
FROM pslist()
WHERE CommandLine =~ '(?i)(7z|winrar|rar|tar|Compress-Archive)'
   AND CommandLine =~ '(?i)(Patients|PHI|Medical|Records|EHR|EMR|Patient|Clinical|HIPAA)'
   AND Username !~ '(?i)(SYSTEM|backup_svc|veeam)'

-- Identify recently created archive files in PHI directories (potential staging)
-- Lookback: last 7 days

SELECT
    FullPath,
    Size,
    Mtime,
    Ctime,
    Owner
FROM glob(globs='**/*.{zip,7z,rar,tar,gz,bak}',
          root='D:\Shares')  -- Adjust to your PHI share root
WHERE Ctime > now() - (7 * 24 * 3600)
  AND Size > 10485760  -- Files larger than 10MB
ORDER BY Ctime DESC

#Requires -RunAsAdministrator
# Healthcare PHI Exposure Audit Script
# Run on domain controllers and file servers hosting patient data
# Author: Security Arsenal — Incident Response Team

Write-Host "==========================================" -ForegroundColor Cyan
Write-Host " Healthcare PHI Exposure Audit" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan

$ReportDate = Get-Date -Format "yyyy-MM-dd_HH-mm"
$ReportPath = "C:\SecurityAudit_$ReportDate.txt"

function Write-Finding {
    param([string]$Severity, [string]$Finding, [string]$Recommendation)
    $color = switch ($Severity) { "CRITICAL" { "Red" } "HIGH" { "Yellow" } "MEDIUM" { "DarkYellow" } default { "White" } }
    Write-Host "[$Severity] $Finding" -ForegroundColor $color
    Add-Content -Path $ReportPath -Value "[$Severity] $Finding"
    Add-Content -Path $ReportPath -Value "    RECOMMENDATION: $Recommendation"
    Add-Content -Path $ReportPath -Value ""
}

# --- 1. Check for accounts without MFA in privileged groups ---
Write-Host "`n[+] Checking privileged account MFA status..." -ForegroundColor Green
try {
    $PrivilegedGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators")
    foreach ($group in $PrivilegedGroups) {
        $members = Get-ADGroupMember -Identity $group -ErrorAction SilentlyContinue |
                   Where-Object { $_.objectClass -eq 'user' }
        foreach ($member in $members) {
            $user = Get-ADUser -Identity $member.SamAccountName -Properties msDS-UserPasswordExpiryTimeComputed, PasswordLastSet, Enabled -ErrorAction SilentlyContinue
            if ($user.Enabled -and $user.PasswordLastSet -lt (Get-Date).AddDays(-365)) {
                Write-Finding "HIGH" "Privileged account $($member.SamAccountName) in $group has password older than 365 days" "Reset password immediately and enforce MFA"
            }
        }
    }
} catch {
    Write-Finding "MEDIUM" "Could not query AD — run on domain controller for full results" "Ensure this script runs with AD module access"
}

# --- 2. Check for unencrypted PHI shares ---
Write-Host "`n[+] Checking for unencrypted network shares..." -ForegroundColor Green
$Shares = Get-SmbShare | Where-Object { $_.Path -match '(?i)(Patients|PHI|Medical|Records|EHR|EMR|Clinical)' }
foreach ($share in $Shares) {
    $encryptStatus = Get-SmbShare -Name $share.Name | Select-Object -ExpandProperty EncryptData
    if (-not $encryptStatus) {
        Write-Finding "CRITICAL" "PHI share $($share.Name) at $($share.Path) does NOT require SMB encryption" "Enable SMB encryption: Set-SmbShare -Name '$($share.Name)' -EncryptData `$true"
    }
    $acl = Get-Acl -Path $share.Path -ErrorAction SilentlyContinue
    $broadAccess = $acl.Access | Where-Object { $_.IdentityReference -match 'Everyone|Authenticated Users' -and $_.FileSystemRights -match 'FullControl|Modify|Write' }
    if ($broadAccess) {
        Write-Finding "CRITICAL" "PHI share $($share.Name) grants write access to Everyone or Authenticated Users" "Restrict NTFS permissions to minimum necessary groups"
    }
}

# --- 3. Check for stale/inactive accounts with network access ---
Write-Host "`n[+] Checking for stale accounts..." -ForegroundColor Green
try {
    $StaleAccounts = Get-ADUser -Filter { Enabled -eq $true } -Properties LastLogonDate |
                     Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) -and $_.LastLogonDate -ne $null }
    if ($StaleAccounts.Count -gt 0) {
        Write-Finding "HIGH" "Found $($StaleAccounts.Count) enabled accounts with no logon in 90+ days" "Disable or remove inactive accounts — these are prime targets for credential abuse"
        $StaleAccounts | Select-Object Name, SamAccountName, LastLogonDate | Format-Table
    }
} catch {
    Write-Host "  Could not query stale accounts" -ForegroundColor Yellow
}

# --- 4. Check for SMBv1 (legacy protocol vulnerable to exploitation) ---
Write-Host "`n[+] Checking SMBv1 status..." -ForegroundColor Green
$SMBv1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($SMBv1 -and $SMBv1.State -eq 'Enabled') {
    Write-Finding "HIGH" "SMBv1 protocol is enabled — vulnerable to known exploitation" "Disable immediately: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol"
} else {
    Write-Host "  SMBv1 is disabled or not present — GOOD" -ForegroundColor Green
}

# --- 5. Check Windows Defender / AV status ---
Write-Host "`n[+] Checking endpoint protection status..." -ForegroundColor Green
$AVStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($AVStatus) {
    if (-not $AVStatus.RealTimeProtectionEnabled) {
        Write-Finding "CRITICAL" "Real-time protection is DISABLED" "Enable immediately: Set-MpPreference -DisableRealtimeMonitoring `$false"
    }
    if ($AVStatus.AntivirusSignatureAge -gt 7) {
        Write-Finding "HIGH" "AV signatures are $($AVStatus.AntivirusSignatureAge) days old" "Force update: Update-MpSignature"
    }
} else {
    Write-Finding "MEDIUM" "Could not query Windows Defender status" "Verify EDR/AV is running and reporting"
}

# --- 6. Check audit policy for file share access ---
Write-Host "`n[+] Checking audit policy for PHI access logging..." -ForegroundColor Green
$AuditPolicy = auditpol /get /subcategory:"File Share" 2>$null
if ($AuditPolicy -match 'No Auditing') {
    Write-Finding "HIGH" "File Share auditing is NOT enabled — you cannot detect unauthorized PHI access" "Enable: auditpol /set /subcategory:`"File Share`" /success:enable /failure:enable"
} else {
    Write-Host "  File Share auditing appears configured — GOOD" -ForegroundColor Green
}

# --- 7. Check for open RDP ---
Write-Host "`n[+] Checking for exposed RDP..." -ForegroundColor Green
$RDPSetting = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($RDPSetting -and $RDPSetting.fDenyTSConnections -eq 0) {
    $RDPPort = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue
    Write-Finding "MEDIUM" "RDP is enabled on port $($RDPPort.PortNumber)" "If not needed, disable. If needed, ensure Network Level Authentication is required and restrict by firewall"
}

Write-Host "`n==========================================" -ForegroundColor Cyan
Write-Host " Audit complete. Report saved to: $ReportPath" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan