Healthcare Data Breaches: Defending Against PHI Exfiltration at LifePoint, Southwest Behavioral & Nottingham Village

---
title: Potential LSASS Memory Dumping for Credential Theft
id: 8a2b1c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects processes attempting to access LSASS memory, often indicative of credential dumping activity associated with data breaches.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
      - '\comsvcs.dll'
      - '\taskmgr.exe'
    CommandLine|contains:
      - 'comsvcs.dll,MiniDump'
      - 'lsa.exe'
      - 'lsass.exe'
  condition: selection
falsepositives:
  - Legitimate debugging by system administrators (rare)
level: high
---
title: High Volume Data Staging via PowerShell
id: b4c5d6e7-89f0-1234-5678-90abcdef1234
status: experimental
description: Detects PowerShell commands often used to compress or archive large quantities of files, a common precursor to data exfiltration in PHI breaches.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pwsh:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_compress:
    CommandLine|contains:
      - 'Compress-Archive'
      - '-Path'
      - '*.pdf'
      - '*.docx'
  condition: all of selection_*
falsepositives:
  - System backup scripts
level: medium
---
title: Suspicious RAR or 7-Zip Archive Creation
id: c6d7e8f9-0123-4567-8901-23456789abcd
status: experimental
description: Detects the creation of compressed archives using RAR or 7-Zip, commonly used by attackers to package PHI for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\rar.exe'
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
  condition: selection and not filter_legit
falsepositives:
  - User-driven file compression
level: low

// Hunt for high volume outbound data transfers from clinical workstations
// Look for connections to non-standard ports or high byte counts
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionInitiated"
| where InitiatingProcessFileName in ("explorer.exe", "powershell.exe", "cmd.exe", "chrome.exe", "msedge.exe")
| summarize TotalBytesSent = sum(SentBytes), ConnectionCount = count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| where TotalBytesSent > 50000000 // 50MB threshold
| sort by TotalBytesSent desc

-- Hunt for processes with handles open to LSASS.exe or sensitive database files
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Exe NOT IN ('C:\\Windows\\System32\\lsass.exe', 'C:\\Windows\\System32\\csrss.exe')
  AND parse_string_with_regex(CommandLine, '(?i)lsass') IS NOT NULL

-- Search for recently created archive files (ZIP, RAR, 7Z) in user directories
SELECT FullPath, Size, Mtime
FROM glob(globs="/*/*.zip", root="C:\\Users\\")
WHERE Mtime > now() - 24h

<#
.SYNOPSIS
    Audits LSASS Protection configurations to mitigate credential dumping.
.DESCRIPTION
    Checks registry keys for RunAsPPL and Debug privilege settings.
#>

Write-Host "[+] Auditing LSASS Protection Level..." -ForegroundColor Cyan

# Check for RunAsPPL (Protected Process Light)
$pplPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
$pplValue = (Get-ItemProperty -Path $pplPath -ErrorAction SilentlyContinue).EnableLUA

# Check LsaCfgFlags (更强的保护)
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$lsaValue = (Get-ItemProperty -Path $lsaPath -ErrorAction SilentlyContinue).RunAsPPL

if ($lsaValue -eq 1) {
    Write-Host "[INFO] RunAsPPL is ENABLED (Value 1)." -ForegroundColor Green
} elseif ($lsaValue -eq 2) {
    Write-Host "[INFO] RunAsPPL is ENABLED with ELAM (Value 2)." -ForegroundColor Green
} else {
    Write-Host "[WARN] RunAsPPL is NOT SET. LSASS is vulnerable to memory dumping." -ForegroundColor Red
    Write-Host "[ACTION] Apply Registry Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 1" -ForegroundColor Yellow
}

Write-Host "[+] Audit Complete."