How to Defend Against Risks from the Healthcare Cybersecurity Skills Gap

---
title: Potential Phishing Payload Execution via PowerShell
id: 4e8f3a21-1b4c-4f2d-9a1e-3c7f6b5d8a9e
status: experimental
description: Detects execution of PowerShell scripts often used in phishing campaigns, such as those downloading files from the internet or encoding commands to avoid detection.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'FromBase64String'
      - 'Invoke-Expression'
  filter:
    CommandLine|contains: 'SignedScripts'
condition: selection and not filter
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Suspicious Multiple Failed Logon Attempts
id: 7a2d8e4f-9c1b-4532-8b7a-1d4e5f6a7b8c
status: experimental
description: Detects multiple failed logon attempts from a single source, which may indicate a brute-force attack or password spraying targeting users with weak password hygiene.
references:
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.credential_access
  - attack.t1110.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'net use'
      - 'psexec'
      - 'wmic'
      - 'tasklist'
  condition: selection
falsepositives:
  - Administrative troubleshooting
level: medium

// Identify potential credential stuffing or password spraying attempts
SigninLogs
| where ResultType == "50126" // Invalid username or password
| summarize FailedLogons = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 5m)
| where FailedLogons > 5
| project UserPrincipalName, IPAddress, FailedLogons, TimeGenerated
| extend Timestamp = TimeGenerated

-- Hunt for suspicious browser history patterns indicative of phishing sites
-- This helps identify users who may have clicked malicious links
SELECT * FROM foreach(
  row={
    SELECT User, Sid FROM artifact_info()
  },
  query={
    SELECT * FROM foreach(
      row={
        SELECT FullPath FROM glob(globs=urlencoding.expand(path='%%AppData%%/Google/Chrome/User Data/*/History'))
      },
      query={
        SELECT
          url.url AS URL,
          url.title AS Title,
          url.visit_time AS LastVisited,
          url.typed_count AS TypedCount
        FROM sqlite(file=FullPath, query="SELECT url, title, last_visit_time, typed_count FROM urls")
        WHERE URL =~ "(login|signin|account|verify|update|secure)" 
          AND Title =~ "(Microsoft 365|Office 365|Google Workspace|Epic|Cerner)"
          AND URL !~ "(microsoft.com|google.com|epic.com|cerner.com)"
      }
    )
  }
)

# Audit Local Admin Group Members to detect potential unauthorized privilege escalation
# Often, untrained staff share local admin credentials to bypass application issues.
$computers = Get-Content -Path "C:\temp\server_list.txt"
foreach ($computer in $computers) {
    try {
        $groupMembers = Get-LocalGroupMember -Group "Administrators" -ComputerName $computer -ErrorAction Stop
        Write-Output "Checking $computer"
        foreach ($member in $groupMembers) {
            # Flag accounts that look like standard users, not service accounts
            if ($member.SID.Value -notmatch "^S-1-5-21-.*-500" -and $member.SID.Value -notmatch "^S-1-5-21-.*-512") {
                Write-Warning "Potential unauthorized admin found: $($member.Name) on $computer"
            }
        }
    } catch {
        Write-Error "Failed to connect to $computer"
    }
}