---
title: Potential EHR Database Export Activity
id: 6e4b5a1d-3c2f-4a8b-9e1d-2f4a5b6c7d8e
status: experimental
description: Detects the use of native database utilities to dump data, which may indicate an attempt to exfiltrate EHR records.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
    CommandLine|contains:
      - ' -o '
      - ' --result-file'
      - ' > '
      - ' OUT '
falsepositives:
  - Legitimate database backups by administrators
level: high
---
title: Suspicious Data Staging in User Directories
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of large archives or database files in user directories, potentially indicating staging for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.exfiltration
  - attack.t1560
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Public\'
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.bak'
      - '.sql'
falsepositives:
  - User creating personal backups
level: medium
---
title: RDP Connection from Non-Standard Workstation
id: 9f8e7d6c-5b4a-3f2e-1d0c-9b8a7f6e5d4c
status: experimental
description: Detects RDP usage initiated by a process or user that does not typically perform administrative tasks, common in lateral movement.
references:
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.lateral_movement
  - attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mstsc.exe'
      - '\freeRD.exe'
    ParentImage|endswith:
      - '\explorer.exe'
  filter:
    User|contains:
      - 'admin'
      - 'service'
falsepositives:
  - Legitimate IT support remote administration
level: medium

// Hunt for unusual database export processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('mysqldump.exe', 'pg_dump.exe', 'sqlcmd.exe', 'bcp.exe')
| where ProcessCommandLine contains_any ('-o', '--result-file', 'OUT', '>')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


// Identify potential data staging files created recently
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath contains_any ('Downloads', 'Temp', 'Public')
| where FileName endswith_cs~ ('.sql', '.bak', '.zip', '.7z', '.mdf')
| project Timestamp, DeviceName, InitiatingProcessAccountName, ActionType, FilePath, SHA256
| where ActionType == 'FileCreated'

-- Hunt for recently created archive files in user directories
SELECT Timestamp, FullPath, Size, Mode.SysTime AS ModTime
FROM glob(globs='C:\Users\*\*.zip', C:\Users\*\*.rar', C:\Users\*\*.7z)
WHERE ModTime > now() - 24h

-- Hunt for EHR database utilities running from unusual locations
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'sqlcmd'
   OR Name =~ 'mysqldump'
   OR Name =~ 'bcp'
   OR Name =~ 'pg_dump'

# Audit EHR Directories for Unauthorized Modifications
$EHRPaths = @("C:\Program Files\EHRSystem", "D:\Database\EHR")
$TimeThreshold = (Get-Date).AddHours(-24)

Write-Host "[+] Scanning for changes in EHR paths in the last 24 hours..." -ForegroundColor Cyan

foreach ($Path in $EHRPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $TimeThreshold } |
        Select-Object FullName, LastWriteTime, Length, @{Name="Owner";Expression={(Get-Acl $_.FullName).Owner}} |
        Format-Table -AutoSize
    } else {
        Write-Host "[-] Path not found: $Path" -ForegroundColor Yellow
    }
}