How to Secure AI-Driven Healthcare Operations Against Data Risks

---
title: Suspicious Database Export Tool Execution
id: 8a7b9c0d-1e2f-3a45-6b78-9c0d1e2f3a45
status: experimental
description: Detects the execution of common database bulk export or command-line tools often used to exfiltrate large datasets for analytics or unauthorized access.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\bcp.exe'
      - '\sqlcmd.exe'
      - '\mysqldump.exe'
      - '\pg_dump.exe'
    CommandLine|contains:
      - 'OUT '
      - 'queryout '
      - 'output '
falsepositives:
  - Legitimate administrative backups or data migrations by DBAs
level: high
---
title: Python AI Framework Execution on Production Servers
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the execution of Python scripts loading AI or data science libraries (pandas, sklearn) on endpoints where they are not typically installed, suggesting potential unauthorized data analysis or malware.
references:
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    CommandLine|contains:
      - 'import pandas'
      - 'import sklearn'
      - 'import tensorflow'
      - 'import torch'
  filter:
    ParentImage|contains:
      - '\Program Files\'
      - '\Anaconda\'
falsepositives:
  - Authorized data science workstations
  - Legitimate server-side analytics tasks
level: medium


**KQL (Microsoft Sentinel/Defender)**

// Detect bulk export of EHR data via SQL commands
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where ProcessVersionInfoOriginalFileName in~("bcp.exe", "sqlcmd.exe")
| where ProcessCommandLine has_any("queryout", "-o", "output")
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FolderPath
| extend Reason = "Potential EHR Data Exfiltration"
;

// Anomalous sign-ins to AI/Analytics Cloud Platforms
SigninLogs
| where AppDisplayName has_any("Azure Machine Learning", "AWS SageMaker", "Google Cloud AI")
| where ResultType == 0
| where ConditionalAccessStatus != "success"
| project Timestamp, UserPrincipalName, AppDisplayName, DeviceDetail, Location, ConditionalAccessStatus
| extend Reason = "AI Platform Access"


**Velociraptor VQL**

-- Hunt for Python or R scripts in sensitive directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="C:\Users\*\*.py", globs="C:\Users\*\*.r")
WHERE Mtime > ago("-7d") 
   AND NOT FullPath =~ "AppData"

-- Check for unauthorized access to database ports
SELECT Pid, Name, UserName, RemoteAddr, LocalAddr, State
FROM netstat()
WHERE LocalPort IN (1433, 3306, 5432, 1521) 
   AND State =~ "ESTABLISHED"
   AND UserName NOT IN ("NT AUTHORITY\SYSTEM", "NT SERVICE\MSSQLSERVER")


**PowerShell (Verification)**

# Audit permissions on EHR data export directories
$Path = "C:\HealthData\Exports"
$Acl = Get-Acl -Path $Path

Write-Host "Current ACL for $Path"
$Acl.Access | Where-Object {$_.IdentityReference -like "*Users*" -or $_.IdentityReference -like "*Everyone*"} | Format-Table IdentityReference, FileSystemRights, AccessControlType -AutoSize

# Check for recently modified database files
Get-ChildItem -Path "C:\Databases" -Recurse -Filter "*.mdf" | 
Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} | 
Select-Object FullName, LastWriteTime, Length