How to Defend Against HIPAA Email Breaches: PHI Encryption and Monitoring Strategies

---
title: Suspicious Outbound SMTP Connection from Endpoint
id: 8a4f2e1c-9b3d-4e5a-8b1c-2d3e4f5a6b7c
status: experimental
description: Detects endpoints establishing connections to standard SMTP ports (25, 587, 465) which may indicate unauthorized email transmission or data exfiltration tools.
references:
  - https://attack.mitre.org/techniques/T1071/003/
author: Security Arsenal
date: 2025/03/29
tags:
  - attack.command_and_control
  - attack.t1071.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 25
      - 587
      - 465
    Initiated: true
  filter:
    Image|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\teams.exe'
condition: selection and not filter
falsepositives:
  - Legitimate email clients using non-standard paths
  - Authorized mail testing utilities used by IT
level: medium
---
title: Outlook Spawning Suspicious Child Process
id: 9b5a3f2d-0c4e-5f6b-9c2d-3e4f5a6b7c8d
status: experimental
description: Detects Microsoft Outlook launching suspicious child processes like PowerShell or CMD, often associated with phishing attachments or macro-based attacks.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2025/03/29
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\outlook.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
condition: selection
falsepositives:
  - Legitimate add-ins or workflow automation scripts
level: high

// Hunt for unauthorized processes connecting to SMTP ports
DeviceNetworkEvents
| where RemotePort in (25, 587, 465, 2525)
| where InitiatingProcessFolderPath !contains "\\Program Files\\"
| where InitiatingProcessFolderPath !contains "\\Program Files (x86)\\"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Timestamp desc


// Identify potential macro-enabled documents downloaded from email
DeviceProcessEvents
| where FileName in ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
| where ProcessCommandLine contains "/m" or ProcessCommandLine contains "/embedding"
| where InitiatingProcessFileName == "OUTLOOK.EXE"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for processes connecting to SMTP ports (25, 587, 465)
SELECT Pid, Name, Exe, Cmdline, RemoteAddress, RemotePort
FROM listen_sockets()
WHERE RemotePort IN (25, 587, 465)
  AND Name NOT IN ("outlook", "thunderbird", "firefox", "chrome", "msedge")

-- Hunt for large .pst/.ost files which might indicate data staging
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="/**/*.{pst,ost,mbox}")
WHERE Size > 500 * 1024 * 1024 -- Larger than 500MB

<#
.SYNOPSIS
    Audit and Harden Protocols for Email Security.
.DESCRIPTION
    Checks registry keys for TLS 1.2 support and disables weak ciphers/protocols.
#>

# Registry Paths
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"

# Ensure TLS 1.2 Client and Server are enabled
@("Client", "Server") | ForEach-Object {
    $Path = "$RegPath\TLS 1.2\$_"
    if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
    Set-ItemProperty -Path $Path -Name "Enabled" -Value 1 -Type DWord
    Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 0 -Type DWord
    Write-Host "Enabled TLS 1.2 $_" -ForegroundColor Green
}

# Disable SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
@("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1") | ForEach-Object {
    @("Client", "Server") | ForEach-Object {
        $Path = "$RegPath\$_\Server"
        if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
        Set-ItemProperty -Path $Path -Name "Enabled" -Value 0 -Type DWord
        Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 1 -Type DWord
        Write-Host "Disabled $_ Server" -ForegroundColor Yellow
    }
}
Write-Host "Protocol hardening complete. Please reboot server for changes to take effect."