Insider Threat: 1.2M Record Geisinger Breach via Nuance — Detection and Hardening Guide

---
title: Potential Mass Data Export via PowerShell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to export large amounts of data or iterate through database objects using PowerShell, common in insider data theft.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2025/04/02
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Export-Csv'
      - 'Out-File'
      - 'Copy-Item'
  filter_large_scale:
    CommandLine|contains:
      - '-Recurse'
      - 'Get-ChildItem'
  condition: selection and filter_large_scale
falsepositives:
  - System administration backups
  - Legitimate reporting scripts
level: high
---
title: Suspicious Removable Media Usage (USB Mass Storage)
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects mass file copy operations to removable media, a common vector for insider exfiltration of large databases.
references:
  - https://attack.mitre.org/techniques/T1052/
author: Security Arsenal
date: 2025/04/02
tags:
  - attack.exfiltration
  - attack.t1052
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\robocopy.exe'
      - '\xcopy.exe'
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - ':\\'
  filter_drive:
    CommandLine|contains:
      - '\\?\\Volume'
      - 'removable'
  condition: selection and filter_drive
falsepositives:
  - Authorized user backups to USB
level: medium
---
title: SQL Bulk Copy Program Usage
id: c3d4e5f6-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects execution of bcp.exe or similar bulk export utilities, which are frequently used to dump entire database tables during insider theft.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2025/04/02
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\bcp.exe'
      - '\sqlcmd.exe'
    CommandLine|contains:
      - 'queryout'
      - 'out '
falsepositives:
  - Legitimate DBA administrative tasks
level: high

// Hunt for high volume of file modifications or creations in user directories
// indicative of bulk data staging for exfiltration.
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath contains "Users"
| extend FileName = tostring(split(FileName, ".")[0])
| summarize Count = count(), Timestamp = max(Timestamp) by AccountName, DeviceName, FolderPath
| where Count > 100 // Threshold for bulk operations
| sort by Count desc

-- Hunt for large compressed archives often created to stage data for theft
-- focusing on RAR, ZIP, or 7z files created in user profiles.
SELECT FullPath, Size, Mtime, Sys.gid as UserId, Sys.uid as UserUid
FROM glob(globs="%%Users\%%\*.zip", root="/")
WHERE Size > 10485760 // Files larger than 10MB
  AND Mtime > now() - 7d

-- Supplemental: Check for recent USB drive connections
SELECT SystemTime, DeviceId, VendorId, ProductId
FROM wmi(query="SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2")
WHERE SystemTime > now() - 7d

# Audit Script: Identify Active Accounts for Terminated Employees
# This script checks AD for users who should be disabled but are not.
# Useful for validating the gap that allowed the Nuance breach.

Import-Module ActiveDirectory

# Define an OU or specific group where third-party/contractors reside
$targetOU = "OU=External Contractors,DC=domain,DC=com"

# Get enabled users in the target area
$riskyUsers = Get-ADUser -Filter {Enabled -eq $true} -SearchBase $targetOU -Properties LastLogonDate, Description

# Check for users with no logon in 90 days but still active (potential stale accounts)
$staleAccounts = $riskyUsers | Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) }

if ($staleAccounts) {
    Write-Host "[!] CRITICAL: Found active accounts with no logon in 90 days:" -ForegroundColor Red
    $staleAccounts | Select-Object Name, SamAccountName, LastLogonDate, Description | Format-Table
} else {
    Write-Host "[+] No stale active accounts found in target OU." -ForegroundColor Green
}

# Export to CSV for remediation ticket
$staleAccounts | Export-Csv -Path "C:\Temp\RiskyThirdPartyAccounts.csv" -NoTypeInformation