Healthcare Insider Threat: 8-Year Pharmacist Spying Campaign — Detection & Defense

---
title: EHR Access to Non-Patient Records
id: 7a8f3c12-d4e5-4f6b-a9c8-1d2e3f4a5b6c
status: experimental
description: Detects healthcare employees accessing EHR records for patients not under their direct care or assignment. Based on MITRE ATT&CK Technique T1213 - Data from Information Repositories.
references:
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.collection
  - attack.t1213
  - insider-threat
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|contains:
      - '\epic.exe'
      - '\cerner.exe'
      - '\allscripts.exe'
    CommandLine|contains:
      - 'patient_lookup'
      - 'record_query'
      - 'phi_access'
    ParentImage|contains:
      - '\explorer.exe'
  filter_legitimate:
    CommandLine|contains:
      - 'current_patient'
      - 'admitted_patients'
      - 'pharmacy_queue'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate cross-coverage queries
  - Emergency department lookups
  - Quality assurance access
level: medium
---
title: Suspicious EHR Data Export Activity
id: 9b2g1h34-e5f6-4g7c-b8d9-2e3f4a5b6c7d
status: experimental
description: Detects potential data exfiltration from EHR systems via print, email, or export functions by healthcare staff. MITRE ATT&CK T1567 - Exfiltration Over Web Service.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.exfiltration
  - attack.t1567
  - insider-threat
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\Downloads\\'
      - '\Desktop\\'
    TargetFilename|endswith:
      - '.pdf'
      - '.csv'
      - '.xlsx'
      - '.docx'
    SourceImage|contains:
      - '\epic.exe'
      - '\cerner.exe'
      - '\allscripts.exe'
  timeframe: 1h
  condition: selection | count() > 10
falsepositives:
  - Legitimate report generation
  - Authorized data exports
level: high
---
title: After-Hours EHR Access Anomaly
id: 1c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects EHR system access outside of normal working hours which may indicate unauthorized surveillance. Based on MITRE ATT&CK T1078 - Valid Accounts.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.privilege_escalation
  - attack.t1078
  - insider-threat
logsource:
  product: windows
  category: process_creation
detection:
  selection_time:
    TimeGenerated:
      - weekday:
          start: '18:00:00'
          end: '23:59:59'
      - weekend:
          start: '00:00:00'
          end: '23:59:59'
  selection_app:
    Image|contains:
      - '\epic.exe'
      - '\cerner.exe'
      - '\meditech.exe'
  selection_command:
    CommandLine|contains:
      - 'patient_record'
      - 'chart_review'
      - 'demographics'
  condition: all of selection_*
falsepositives:
  - On-call pharmacy staff
  - Emergency response teams
  - Resident physicians
level: medium

// KQL Hunt Query: Excessive EHR Record Access Patterns
// Hunt for users accessing unusually high volumes of patient records
let TimeRange = 7d;
let EHRApplications = dynamic(["epic.exe", "cerner.exe", "meditech.exe", "allscripts.exe", "mckesson.exe"]);
let SuspiciousKeywords = dynamic(["patient_lookup", "record_query", "demographics", "phi_access", "chart_review"]);
let NormalAccessThreshold = 50; // Adjust based on baseline

DeviceProcessEvents
| where Timestamp >= ago(TimeRange)
| where FileName in~ EHRApplications
| where ProcessCommandLine has_any (SuspiciousKeywords)
| summarize RecordAccessCount = count(), AccessedPatients = dcount(ProcessCommandLine) by AccountName, DeviceName, bin(Timestamp, 1h)
| where RecordAccessCount > NormalAccessThreshold
| extend RiskScore = iff(RecordAccessThreshold > NormalAccessThreshold * 2, "High", "Medium")
| project Timestamp, AccountName, DeviceName, RecordAccessCount, AccessedPatients, RiskScore
| order by RecordAccessCount desc
| join kind=leftouter (
    IdentityInfo
    | project AccountName, Department, JobTitle
) on AccountName
| where JobTitle !contains "pharmacy" // Flag non-pharmacy staff accessing pharmacy-like queries


// KQL Hunt Query: Coworker/Employee Record Access Pattern
// Detect users querying records of other employees
let TimeRange = 30d;
// In production, this would reference your HR database of employee identifiers
let EmployeeIdentifiers = dynamic(["EMP", "STAFF", "DOCTOR", "NURSE", "ADMIN"]);

DeviceProcessEvents
| where Timestamp >= ago(TimeRange)
| where FileName in~ ("epic.exe", "cerner.exe", "meditech.exe")
| extend RecordIdentifier = extract(@'patient_id\s*=\s*[\"\']?([\w-]+)', 1, ProcessCommandLine)
| where RecordIdentifier has_any (EmployeeIdentifiers)
| summarize AccessedEmployeeRecords = dcount(RecordIdentifier), AccessEvents = count() by AccountName, bin(Timestamp, 1d)
| where AccessedEmployeeRecords > 0
| project Timestamp, AccountName, AccessedEmployeeRecords, AccessEvents
| order by AccessedEmployeeRecords desc

-- Velociraptor VQL: Hunt for EHR Application Artifacts and Evidence
-- Collect process execution history and EHR application logs

SELECT * FROM foreach(
    row={
        SELECT ProcessName, Pid, Ppid, StartTime, Username, CommandLine
        FROM pslist()
        WHERE ProcessName =~ 'epic.exe'
           OR ProcessName =~ 'cerner.exe'
           OR ProcessName =~ 'meditech.exe'
    },
    query={
        SELECT
            ProcessName,
            Pid,
            StartTime,
            Username,
            CommandLine,
            Mtime as LastModified,
            Size
        FROM glob(globs='\Users\' + Username + '\AppData\Local\' + ProcessName + '\Logs\*.log')
    }
)

-- Hunt for suspicious EHR data exports in user directories
SELECT FullPath, Size, Mtime, Atime, Btime, Mode
FROM glob(globs='C:\Users\*\Downloads\*{patient,record,phi,medical}*.csv')
UNION SELECT FullPath, Size, Mtime, Atime, Btime, Mode
FROM glob(globs='C:\Users\*\Desktop\*{patient,record,phi,medical}*.pdf')

-- Network connections from EHR applications to external destinations
SELECT Pid, RemoteAddress, RemotePort, State, StartTime
FROM netstat()
WHERE Pid IN (
    SELECT Pid FROM pslist()
    WHERE ProcessName =~ 'epic.exe'
       OR ProcessName =~ 'cerner.exe'
)
AND RemoteAddress NOT IN ("127.0.0.1", "::1")
AND RemotePort NOT IN (443, 80) // Exclude standard web traffic

# PowerShell Script: Healthcare Insider Threat Hardening and Verification
# Run as Administrator on domain controllers or EHR management servers

Write-Host "[+] Starting Healthcare Insider Threat Hardening Check" -ForegroundColor Cyan

# 1. Verify EHR Application Logging is Enabled
Write-Host "`n[+] Checking EHR Application Logging Configuration..." -ForegroundColor Yellow
$ehrApps = @("Epic", "Cerner", "Meditech", "Allscripts", "McKesson")
foreach ($app in $ehrApps) {
    $logPath = "HKLM:\SOFTWARE\$app\Logging"
    if (Test-Path $logPath) {
        $auditEnabled = (Get-ItemProperty -Path $logPath -ErrorAction SilentlyContinue).AuditLogLevel
        Write-Host "    [-] $app Logging: $auditEnabled" -ForegroundColor $(if($auditEnabled -ge 2){"Green"}else{"Red"})
    }
}

# 2. Check for Privileged Group Membership Anomalies
Write-Host "`n[+] Checking for Privileged EHR Access Groups..." -ForegroundColor Yellow
$privGroups = @("EHR-Admins", "EHR-SuperUsers", "EMR-FullAccess", "PHI-All-Access")
foreach ($group in $privGroups) {
    try {
        $members = Get-ADGroupMember -Identity $group -ErrorAction Stop | Select-Object -ExpandProperty Name
        Write-Host "    [-] $group has $($members.Count) members" -ForegroundColor Cyan
        if ($members.Count -gt 10) {
            Write-Host "    [!] WARNING: High number of privileged users detected" -ForegroundColor Red
        }
    } catch {
        Write-Host "    [-] Group $group not found or inaccessible" -ForegroundColor Gray
    }
}

# 3. Verify Audit Policies for PHI Access
Write-Host "`n[+] Verifying Advanced Audit Policy for Object Access..." -ForegroundColor Yellow
$auditPolicy = auditpol /get /subcategory:"File System" 2>&1
if ($auditPolicy -match "Success and Failure") {
    Write-Host "    [-] File System auditing: ENABLED" -ForegroundColor Green
} else {
    Write-Host "    [!] File System auditing: NOT ENABLED" -ForegroundColor Red
}

# 4. Check for Recently Created EHR Data Exports
Write-Host "`n[+] Scanning for Recent EHR Data Exports (Last 7 Days)..." -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
$exportPaths = @(
    "C:\Users\*\Downloads\*.csv",
    "C:\Users\*\Downloads\*.xlsx",
    "C:\Users\*\Desktop\*.pdf",
    "C:\Temp\*\*.csv"
)

$suspiciousExports = foreach ($path in $exportPaths) {
    Get-ChildItem -Path $path -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoffDate -and $_.Length -gt 100KB }
}

if ($suspiciousExports) {
    Write-Host "    [!] Found $($suspiciousExports.Count) suspicious recent exports" -ForegroundColor Red
    $suspiciousExports | Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
} else {
    Write-Host "    [-] No suspicious recent exports found" -ForegroundColor Green
}

# 5. Generate Recommendation Report
Write-Host "`n[+] GENERATING HARDENING RECOMMENDATIONS..." -ForegroundColor Yellow
$recommendations = @(
    "Implement User and Entity Behavior Analytics (UEBA) for EHR access",
    "Enable quarterly access reviews for EHR privileged groups",
    "Configure automated alerts for off-hours PHI access",
    "Implement role-based access control (RBAC) with principle of least privilege",
    "Enable comprehensive audit logging for all EHR record access",
    "Deploy Data Loss Prevention (DLP) for PHI export channels",
    "Establish separation of duties between clinical and administrative access",
    "Implement automated monitoring for coworker/employee record access"
)

$recommendations | ForEach-Object { Write-Host "    [+] $_" -ForegroundColor White }

Write-Host "`n[+] Hardening Check Complete" -ForegroundColor Green