IDScan Breach and Class Action Fallout: Defending Driver's License PII Stores Against Bulk Exfiltration

---
title: Bulk Database Export Utility Execution on Server Hosting PII
id: 3f8a1b72-6c4d-4e91-a2b7-9d5e0f1c8a34
status: experimental
description: Detects execution of native database dump/export utilities commonly used to bulk-extract PII from backend data stores prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
  - attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\mongoexport.exe'
      - '\sqlservr.exe'
  selection_dump_args:
    CommandLine|contains:
      - '--all-databases'
      - ' --databases '
      - 'SELECT *'
      - 'OUT'
      - 'queryout'
      - '--collection'
  condition: selection_image and selection_dump_args
falsepositives:
  - Scheduled backup jobs - baseline and whitelist by service account and scheduled task name
  - DBA maintenance activity during approved change windows
level: high
---
title: Archive Creation Staging Followed by Exfiltration Tooling
id: 8c2d4e61-1a9f-4b83-b6e2-7f0a3d9c5e18
status: experimental
description: Detects compression/archiving of data directories combined with execution of exfiltration-capable tools such as Rclone, a common staging pattern before theft of PII stores.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_archive_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.7z'
      - '.rar'
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\aws.exe'
      - '\azcopy.exe'
  selection_exfil_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - 's3://'
      - '--transfers'
  condition: (selection_archive and selection_archive_args) or (selection_exfil and selection_exfil_args)
falsepositives:
  - Legitimate backup software using embedded 7-Zip - filter by parent process and install path
  - Cloud sync agents deployed by IT
level: high
---
title: Abnormal Service Account Access to PII Database Host
id: 5b7e9c14-2d6a-4f18-93c4-1e8b6a2d7f52
status: experimental
description: Detects interactive logon to database or application servers hosting identity document data by accounts that normally authenticate only as service or batch logons.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    LogonType:
      - 2
      - 10
    TargetUserName|contains:
      - 'svc_'
      - 'svc-'
      - '_svc'
      - 'service'
      - 'sql'
      - 'backup'
  filter_known_hosts:
    WorkstationName:
      - 'Approved-Jumpbox-01'
  condition: selection and not filter_known_hosts
falsepositives:
  - Administrators troubleshooting under a service context - enforce named admin accounts instead
level: medium

let PIIHosts = dynamic(["ids-db-01", "visitor-db-prod", "kyc-api-backend"]);
let DumpTools = dynamic(["mysqldump.exe", "pg_dump.exe", "sqlcmd.exe", "bcp.exe", "mongoexport.exe", "rclone.exe", "megacmd.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where DeviceName has_any (PIIHosts)
| where FileName has_any (DumpTools)
   or ProcessCommandLine has_any ("--all-databases", "queryout", "rclone copy", "rclone sync", "pg_dump")
| summarize FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            CommandLines = make_set(ProcessCommandLine, 5),
            Accounts = make_set(AccountName)
  by DeviceName, FileName, SHA256
| extend Severity = case(
    FileName in~ ("rclone.exe", "megacmd.exe"), "High - Exfiltration tooling on PII host",
    "Medium - Bulk export utility on PII host")
| sort by FirstSeen desc;
// Correlate with large egress from the same hosts in the same window
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where SourceHostName has_any (PIIHosts)
| summarize TotalBytesOut = sum(tolong(SentBytes)), Destinations = make_set(DestinationAddress, 10) by SourceHostName
| where TotalBytesOut > 500000000
| project SourceHostName, TotalBytesOutGB = round(TotalBytesOut / 1073741824.0, 2), Destinations;

-- Hunt for database dump artifacts and exfiltration staging on PII hosts
SELECT Fqdn,
       Pid,
       Name,
       CommandLine,
       Exe,
       Username
FROM pslist()
WHERE CommandLine =~ '(mysqldump|pg_dump|mongoexport|bcp |queryout|rclone|megacmd|7z a |rar a )'
   OR Exe =~ '(rclone|megacmd|7z|winrar)\\.exe$'

-- Enumerate recently created large archives and dump files in data and temp paths
SELECT FullPath,
       Size / 1048576 AS SizeMB,
       Mtime
FROM glob(globs=['C:/Temp/**/*.7z', 'C:/Temp/**/*.zip', 'C:/Temp/**/*.sql',
                 'C:/ProgramData/**/*.sql', 'C:/ProgramData/**/*.bak',
                 'D:/Backups/**/*.sql', '/tmp/**/*.sql', '/tmp/**/*.tar.gz',
                 '/var/tmp/**/*.sql'])
WHERE Mtime > now() - 1209600
  AND Size > 104857600
ORDER BY Mtime DESC

-- Check for established outbound connections on uncommon ports from database servers
SELECT Fqdn, Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND Raddr.IP !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'
  AND Name =~ '(sqlservr|mysqld|postgres|mongod|rclone|megacmd)'

# Security Arsenal - PII Store Hardening & Breach-Exposure Audit
# Run elevated on servers hosting driver's license / identity document data

Write-Host "[1] Scanning for unauthorized bulk-export and exfiltration tooling..." -ForegroundColor Cyan
$suspectTools = @('rclone.exe','megacmd.exe','7z.exe','7za.exe','rar.exe','mysqldump.exe','pg_dump.exe','mongoexport.exe')
$searchPaths = @('C:\Temp','C:\ProgramData','C:\Users\Public','C:\inetpub')
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $suspectTools -contains $_.Name } |
            Select-Object FullName, Length, LastWriteTime
    }
}

Write-Host "[2] Checking for staged archives/dumps larger than 100MB modified in last 30 days..." -ForegroundColor Cyan
Get-ChildItem -Path 'C:\','D:\' -Recurse -Include *.7z,*.rar,*.zip,*.sql,*.bak -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 100MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}}, LastWriteTime

Write-Host "[3] Verifying audit policy for sensitive object and process tracking..." -ForegroundColor Cyan
auditpol /get /subcategory:"Process Creation","File System","Security Group Management","Sensitive Privilege Use"
# Enable if not present:
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable

Write-Host "[4] Enabling command-line capture in process creation events (Event 4688)..." -ForegroundColor Cyan
$regPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
Set-ItemProperty -Path $regPath -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord

Write-Host "[5] Auditing service accounts with interactive logon rights (should be none)..." -ForegroundColor Cyan
Get-LocalUser | Where-Object { $_.Name -match 'svc|service|sql|backup' -and $_.Enabled } |
    Select-Object Name, Enabled, LastLogon, PasswordLastSet
Get-LocalGroupMember -Group 'Remote Desktop Users' -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'svc|service' } |
    Select-Object Name, ObjectClass, PrincipalSource

Write-Host "[6] Reviewing outbound firewall posture - deny-by-default egress for DB servers is the goal..." -ForegroundColor Cyan
Get-NetFirewallProfile | Select-Object Name, DefaultOutboundAction
# Harden: block all outbound except approved backup/monitoring destinations
# Set-NetFirewallProfile -Profile Domain -DefaultOutboundAction Block

Write-Host "[7] Checking scanned-document storage for excessive retention (minimization check)..." -ForegroundColor Cyan
$docStores = @('D:\Scans','C:\IDScanData','C:\ProgramData\IDScan')
foreach ($store in $docStores) {
    if (Test-Path $store) {
        $stale = Get-ChildItem $store -Recurse -File -ErrorAction SilentlyContinue |
                 Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-90) }
        Write-Host "$store : $($stale.Count) files older than 90 days - review retention policy"
    }
}
Write-Host "Audit complete. Route all findings to your IR and privacy counsel." -ForegroundColor Green