INC Ransomware Targets Healthcare — Encryption-Based Attack Detection and Defense

---
title: Suspicious Mass File Encryption Pattern - INC Ransomware Indicator
id: 8a4f2c1d-7e3b-4a9f-9c5d-2e6f8a1b3c4d
status: experimental
description: Detects rapid file modification patterns consistent with ransomware encryption activity, targeting healthcare data directories.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\EMR\\'
      - '\\PACS\\'
      - '\\MedicalRecords\\'
      - '\\PatientData\\'
    Image|endswith:
      - '\.exe'
  condition: selection | count() > 50
timeframe: 2m
falsepositives:
  - Legitimate bulk data migrations
  - Database backup operations
level: high
---
title: INC Ransomware Suspicious PowerShell Execution Pattern
id: 3b7d1e9a-5c2f-4e8b-9a1d-6f4c2e8b3a7c
status: experimental
description: Detects PowerShell commands consistent with INC ransomware propagation and encryption commands observed in recent healthcare incidents.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-AESEncryption'
      - '-encrypt'
      - 'ICACLS'
      - '/grant'
      - ':F'
      - '/T'
      - '/C'
  condition: selection
falsepositives:
  - Legitimate administrative scripting
  - Authorized encryption utilities
level: high
---
title: Ransomware Lateral Movement via SMB - Healthcare Network
id: 9c6e3f2a-1d8b-4c7e-a5f9-7d4e2c8b1a6f
status: experimental
description: Detects SMB-based lateral movement patterns consistent with INC ransomware propagation across healthcare network segments.
references:
  - https://attack.mitre.org/techniques/T1021/002/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    Initiated: 'true'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wmiprvse.exe'
  filter:
    DestinationIp|contains:
      - '10.0.0.'
      - '192.168.'
  condition: selection and filter
falsepositives:
  - Legitimate administrative file access
  - Authorized SMB management tools
level: medium

// Hunt for mass file encryption indicative of INC ransomware in healthcare environments
let encryptionThreshold = 50;
let timeWindow = 5m;
DeviceFileEvents
| where Timestamp > ago(timeWindow)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has "EMR" or FolderPath has "PACS" or FolderPath has "Patient" or FolderPath has "Medical"
| where InitiatingProcessFileName !in ~("sqlservr.exe", "osql.exe", "backup.exe", "vss.exe", "wbadmin.exe")
| summarize FileCount = count(), EncryptedFiles = make_set(FileName) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, timeWindow)
| where FileCount >= encryptionThreshold
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FileCount, Timestamp
| order by FileCount desc


// Detect potential INC ransomware command execution patterns
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("encrypt", "AES", "ICACLS", "/grant", ":F", "/T", "/C", "/remove")
| where ProcessCommandLine has_any ("*.emr", "*.pacs", "*.dicom", "*.hl7", "patient", "medical")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


// Identify anomalous SMB connections suggesting lateral movement
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where RemotePort == 445
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionInitiated"
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wmiprvse.exe", "psexec.exe", "psexec64.exe")
| extend IsInternal = ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16")
| where IsInternal == true
| summarize Count = count(), Connections = make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where Count > 10
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, Count, Connections, Timestamp
| order by Count desc

-- Hunt for processes exhibiting ransomware-like encryption behavior
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, 
       count(id) as HandleCount
FROM pslist()
GROUP BY Pid, Name, CommandLine, Exe, Username, CreateTime
HAVING HandleCount > 100
ORDER BY HandleCount DESC


-- Identify suspicious file modifications in healthcare-critical directories
SELECT FileName, FullPath, Size, ModTime, Mode,
       Mtime AS LastModified
FROM glob(globs="/*/*/{EMR,PACS,MedicalRecords,PatientData}/**/*")
WHERE ModTime > now() - 10m
ORDER BY ModTime DESC


-- Detect network connections indicative of lateral movement
SELECT Fd, RemoteAddress, RemotePort, State, PID, Cmdline, Username
FROM netstat()
WHERE RemotePort = 445
  AND State =~ 'ESTABLISHED'
  AND RemoteAddress !~ '127.0.0.1'
ORDER BY RemoteAddress

# INC Ransomware Healthcare Hardening Script
# Run as Administrator on critical healthcare workstations and servers

Write-Host "Starting INC Ransomware Healthcare Hardening..." -ForegroundColor Cyan

# 1. Enable PowerShell Script Block Logging
Write-Host "[+] Configuring PowerShell Script Block Logging..."
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (!(Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
}
Set-ItemProperty -Path $registryPath -Name "EnableScriptBlockLogging" -Value 1 -Force

# 2. Disable SMBv1 (known ransomware propagation vector)
Write-Host "[+] Disabling SMBv1 protocol..."
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

# 3. Configure PowerShell Constrained Language Mode
Write-Host "[+] Setting PowerShell Constrained Language Mode..."
$systemRoot = $env:SystemRoot
$system32Path = Join-Path $systemRoot "System32"
$wow64Path = Join-Path $systemRoot "SysWOW64"
$powershellConfigs = @(
    (Join-Path $system32Path "powershell.exe"),
    (Join-Path $system32Path "pwsh.exe"),
    (Join-Path $wow64Path "powershell.exe")
)

foreach ($config in $powershellConfigs) {
    if (Test-Path $config) {
        $appLockerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppLocker"
        $psPolicyPath = Join-Path $appLockerPath "Script"
        if (!(Test-Path $psPolicyPath)) {
            New-Item -Path $psPolicyPath -Force | Out-Null
        }
        Set-ItemProperty -Path $psPolicyPath -Name "EnforcementMode" -Value 1 -Force
    }
}

# 4. Block RDP from internet-facing interfaces
Write-Host "[+] Auditing RDP exposure..."
$rdpStatus = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections"
if ($rdpStatus.fDenyTSConnections -eq 0) {
    Write-Host "WARNING: RDP is enabled. Please verify it is not exposed to internet." -ForegroundColor Yellow
    $firewallRule = Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -ErrorAction SilentlyContinue
    if ($firewallRule) {
        $remoteIp = $firewallRule | Get-NetFirewallAddressFilter
        Write-Host "Current RDP allowed IPs: $($remotePolicy.RemoteAddress)"
    }
}

# 5. Enable Microsoft Defender Antivirus Ransomware Protection
Write-Host "[+] Enabling Controlled Folder Access..."
Set-MpPreference -EnableControlledFolderAccess Enabled

# Add healthcare-critical folders to protected list
$protectedFolders = @(
    "$env:ProgramFiles\EMR",
    "$env:ProgramFiles\PACS",
    "C:\MedicalRecords",
    "C:\PatientData"
)

foreach ($folder in $protectedFolders) {
    if (Test-Path $folder) {
        Add-MpPreference -ControlledFolderAccessProtectedFolders $folder
        Write-Host "    Added protection for: $folder"
    }
}

# 6. Audit and restrict WMI access
Write-Host "[+] Configuring WMI security..."
$wmicPath = Join-Path $env:SystemRoot "System32\wbem"
if (Test-Path $wmicPath) {
    $wmicExe = Join-Path $wmicPath "wmic.exe"
    if (Test-Path $wmicExe) {
        $acl = Get-Acl $wmicExe
        $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
            "BUILTIN\Users",
            "ReadAndExecute",
            "ContainerInherit,ObjectInherit",
            "None",
            "Allow"
        )
        $acl.SetAccessRule($accessRule)
        Set-Acl $wmicExe $acl
    }
}

Write-Host ""
Write-Host "Healthcare hardening complete." -ForegroundColor Green
Write-Host "RECOMMENDATION: Review backup isolation and schedule reboot if services were modified." -ForegroundColor Yellow