Healthcare Services Group $3M Settlement: Defending Against PHI Data Breaches and Litigation

---
title: Potential Mass Data Staging via Robocopy
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the use of robocopy with flags typically used for mass data copying or mirroring, which may indicate data staging for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1074/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1074.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\robocopy.exe'
    CommandLine|contains:
      - '/MIR'
      - '/COPYALL'
      - '/E'
  condition: selection
falsepositives:
  - Legitimate system backup operations
  - Administrative file migrations
level: medium
---
title: Suspicious PowerShell Upload/Exfiltration Patterns
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell commands often used to upload files to remote services or APIs, a common exfiltration technique.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'OutFile'
  filter_legit:
    CommandLine|contains:
      - 'WindowsUpdate'
      - 'MicrosoftUpdate'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software updates or installation scripts
level: high

// Hunt for mass file access patterns indicative of data staging
// Focus on high volume of file modifications or reads in short timeframes
let TimeWindow = 1h;
DeviceFileEvents
| where Timestamp > ago(TimeWindow)
| where ActionType in ("FileCreated", "FileModified")
| summarize count() by DeviceName, InitiatingProcessAccountName, FolderPath = bin(FolderPath, 10)
| where count_ > 100 // Threshold for mass activity
| project DeviceName, InitiatingProcessAccountName, FolderPath, FileCount = count_
| order by FileCount desc

-- Hunt for recently created archives (zip, rar, 7z) which are often used to stage PHI for exfiltration
SELECT FullPath, Size, Mtime, Mode.SysType
FROM glob(globs='/*/*.zip', /*/*.rar, /*/*.7z)
WHERE Mtime > now() - 24h
  AND Size > 1024 * 1024 // Larger than 1MB to ignore small logs

# Audit: Identify Sensitive Directories with Excessive Permissions
# This script checks common PHI storage locations for "Everyone" or "Authenticated Users" write access.

$SensitivePaths = @("C:\PatientData", "C:\Records", "D:\HR", "\\fileserver\PHI")
$RiskyGroups = @("Everyone", "Authenticated Users", "BUILTIN\Users")

foreach ($Path in $SensitivePaths) {
    if (Test-Path $Path) {
        $Acl = Get-Acl -Path $Path
        foreach ($Access in $Acl.Access) {
            foreach ($Group in $RiskyGroups) {
                if ($Access.IdentityReference.Value -eq $Group -and $Access.FileSystemRights -match "Write|Modify|FullControl") {
                    Write-Host "[ALERT] Risky permissions found on $Path" -ForegroundColor Red
                    Write-Host "  Group: $($Access.IdentityReference.Value)" -ForegroundColor Yellow
                    Write-Host "  Rights: $($Access.FileSystemRights)" -ForegroundColor Yellow
                }
            }
        }
    }
}