Healthcare Data Breaches: Analysis of Illinois & Texas Incidents and Defending Against PHI Exfiltration

---
title: Potential Mass Email Export via Office 365
id: 8a4b3c2d-1e0f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential mass export or access of mail items, often indicative of data staging in BEC incidents. Focuses on OfficeActivity logs indicating high volume interaction.
references:
  - https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.collection
  - attack.t1114.002
  - attack.exfiltration
logsource:
  product: o365
  service: exchange
detection:
  selection:
    Operation|contains:
      - 'SearchQueryStarted'
      - 'UpdateInboxRules'
      - 'New-MailboxExportRequest'
    ClientIP|cidr:
      - '0.0.0.0/0' # Filter internal trusted ranges in prod
  condition: selection | count() > 50
  timeframe: 15m
falsepositives:
  - Legitimate mailbox migration activities
  - Bulk user cleanup by admins
level: high
---
title: Suspicious Compression of Sensitive Directories
id: 9d5c4e3f-2f1a-5b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious compression processes (e.g., PowerShell, WinRAR, 7-Zip) creating archives in user profiles or temp folders, common in data staging before exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\winrar.exe'
      - '\7z.exe'
  selection_cli:
    CommandLine|contains:
      - 'Compress-Archive'
      - '-a' # 7zip/rar add switch
      - 'a -tzip'
  selection_path:
    CommandLine|contains:
      - 'C:\Users\Public\'
      - 'C:\Temp\'
      - 'C:\ProgramData\'
      - 'AppData\Local\Temp'
  condition: all of selection_*
falsepositives:
  - Legitimate system backups
  - IT support archiving logs
level: high
---
title: Large Volume Egress via Non-Standard Browser
id: 0e1f2a3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Identifies large data transfers from endpoints to the internet via processes other than major browsers, potentially indicating FTP or custom upload tools used in exfiltration.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|notcontains:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
  filter:
    DestinationPort:
      - 80
      - 443
      - 8080
  condition: selection and not filter | count(DestBytes) > 50000000
  timeframe: 5m
falsepositives:
  - Video conferencing traffic
  - Software updates
level: medium

// Hunt for unusual MailItemsAccessed patterns indicative of PHI harvesting
OfficeActivity
| where Operation == "MailItemsAccessed"
| extend Folder = parse_(Folders)[0]
| where Folder contains "Inbox" or Folder contains "Sent" or Folder contains "Archive"
| summarize AccessCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserId, ClientIP, Operation
| where AccessCount > 100
| extend IPInfo = split(ClientIP, ':')[0]
| project StartTime, EndTime, UserId, IPInfo, AccessCount
| order by AccessCount desc

// Correlate sign-in anomalies with subsequent data export activities
SigninLogs
| where ResultType == 0
| where RiskLevelDuringSignIn in ("medium", "high")
| project SignInTime = TimeGenerated, UserPrincipalName, IPAddress, DeviceDetail, Location
| join (
    OfficeActivity
    | where Operation in ("Export", "New-MailboxExportRequest", "CreateFolder")
    | project ExportTime = TimeGenerated, UserId, Operation, ClientIP
) on $left.UserPrincipalName == $right.UserId
| where ExportTime between (SignInTime .. SignInTime + 1h)
| project SignInTime, ExportTime, UserPrincipalName, IPAddress, Operation, Location

-- Hunt for recently created archives in user profiles which may contain staged PHI
SELECT FullPath, Size, Mtime, Btime, Mode
FROM glob(globs='C:\Users\*\*.zip', globs='C:\Users\*\*.rar', globs='C:\Users\*\*.7z')
WHERE Mtime > now() - 7d
  AND Size > 1024 * 1024 // Greater than 1MB

-- Hunt for PowerShell processes that may be used for data dumping
SELECT Pid, Name, CommandLine, Exe, StartTime, Username
FROM pslist()
WHERE Name =~ "powershell.exe"
  AND (CommandLine =~ "Compress-Archive" OR CommandLine =~ "Export-Csv" OR CommandLine =~ "Out-File")
  AND StartTime > now() - 1h

<#
.SYNOPSIS
    Audit and Remediate Potential PHI Staging Locations.
.DESCRIPTION
    This script scans common user directories for large compressed archives created
    within the last 24 hours and outputs a report for IR review. It also checks for
    suspicious Inbox Rules often used in BEC to hide exfiltration activity.
#>

# Define Timeframe
$Date = (Get-Date).AddDays(-1)
$ReportPath = "C:\Temp\PHI_Staging_Report.txt"

# Scan for suspicious archives
Write-Host "Scanning for recently created archives..."
$SuspiciousFiles = Get-ChildItem -Path "C:\Users\" -Recurse -Include @("*.zip","*.rar","*.7z") -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt $Date -and $_.Length -gt 5MB }

if ($SuspiciousFiles) {
    $SuspiciousFiles | Select-Object FullName, LastWriteTime, Length, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}} | Out-File $ReportPath
    Write-Host "Suspicious files found. Report generated at $ReportPath"
    # In a real IR scenario, you might quarantine these files:
    # $SuspiciousFiles | Move-Item -Destination "C:\Quarantine\" -Force
} else {
    Write-Host "No suspicious archives found matching criteria."
}

# Check for Suspicious Inbox Rules (requires Exchange Online Module or local Exchange shell access)
# This is a placeholder for the logic to run on a mail server or via API
Write-Host "Checking for suspicious Inbox Rules (API connection required)..."
# Get-InboxRule -Mailbox "affected.user@domain.com" | Where-Object { $_.ForwardTo -ne $null -or $_.RedirectTo -ne $null }