Henderson & Walton Settlement: Defending Against Healthcare PHI Data Breaches

---
title: Potential Data Staging via WinRAR Command Line
id: 8a2b4c1d-9e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects the use of WinRAR (rar.exe) with command-line switches indicative of data archiving and potential staging for exfiltration. Adversaries often use compression to hide data volume and bypass DLP.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - 'a -' # Add to archive
      - '-hp' # Encrypt with password
  condition: selection
falsepositives:
  - Legitimate administrative backups (rare on user workstations)
level: high
---
title: Potential Data Staging via 7-Zip with Encryption
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the use of 7-Zip (7z.exe) creating archives with passwords, a common method used by threat actors to package stolen PHI.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\7z.exe'
    CommandLine|contains:
      - 'a ' # Add command
      - '-p' # Password parameter
  condition: selection
falsepositives:
  - Known backup scripts
level: high
---
title: Suspicious PowerShell Invoke-WebRequest for Data Exfiltration
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PowerShell scripts attempting to upload data to external endpoints using Invoke-WebRequest or WebClient, common for exfiltrating smaller datasets or credentials.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_script:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmdlet:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'WebClient'
  selection_params:
    CommandLine|contains:
      - '-Method POST'
      - '-Body'
  condition: all of selection_*
falsepositives:
  - Legitimate update scripts or system management tools
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for suspicious archiving processes (WinRAR, 7-Zip) on servers or workstations
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("rar.exe", "winrar.exe", "7z.exe", "zip.exe")
| where ProcessCommandLine contains_any ("a ", "-m", "-hp", "-p")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend Timestamp
| order by Timestamp desc


// Hunt for high volume outbound network connections (Potential Exfiltration)
DeviceNetworkEvents
| where Timestamp > ago(12h)
| where RemotePort in (443, 80) or RemotePort >= 8000
| where ActionType == "ConnectionSuccess"
| summarize TotalBytesSent = sum(SentBytes), Count = count() by DeviceName, RemoteUrl, RemoteIP
| where TotalBytesSent > 50000000 // Greater than 50MB sent to single destination
| project DeviceName, RemoteUrl, RemoteIP, TotalBytesSent, Count
| order by TotalBytesSent desc


**Velociraptor VQL**

-- Hunt for recently created RAR/ZIP/7Z files in user directories and common data folders
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/Users/*/*.rar", root=/)
WHERE Mtime > now() - 24h

UNION ALL

SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/Users/*/*.zip", root=/)
WHERE Mtime > now() - 24h

UNION ALL

SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/Users/*/*.7z", root=/)
WHERE Mtime > now() - 24h


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
    Audit script to detect unauthorized archives in PHI-sensitive directories.
.DESCRIPTION
    Scans defined root paths for RAR, ZIP, and 7Z files created within the last 7 days.
    This helps identify potential data staging points left by an intruder.
#>

$LogPath = "C:\Windows\Temp\PHI_Audit_Log.txt"
$ScanPaths = @("C:\PHI_Data", "D:\Patient_Records", "\\EHR-Server\Shares")
$ExtensionFilter = @("*.rar", "*.zip", "*.7z")
$DaysToScan = 7

Write-Output "Starting PHI Archive Audit..." | Out-File -FilePath $LogPath -Append

foreach ($Path in $ScanPaths) {
    if (Test-Path $Path) {
        Write-Output "Scanning Path: $Path" | Out-File -FilePath $LogPath -Append
        Get-ChildItem -Path $Path -Recurse -Include $ExtensionFilter -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-$DaysToScan) } | 
        Select-Object FullName, LastWriteTime, Length, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}} | 
        Export-Csv -Path "$LogPath.csv" -Append -NoTypeInformation
    }
}
Write-Output "Audit Complete. Review CSV output." | Out-File -FilePath $LogPath -Append