Insider Threat Defense: Detecting Unauthorized PHI Access in Healthcare

Introduction

A recent incident involving a Colorado Behavioral Healthcare Provider highlights a persistent and dangerous reality for healthcare organizations: the insider threat. Unlike external ransomware attacks, insider breaches exploit legitimate credentials to bypass perimeter defenses, making detection notoriously difficult. When a trusted user abuses their access to exfiltrate Protected Health Information (PHI), the impact is severe—ranging from regulatory fines under HIPAA to irreparable reputational damage and patient harm. Defenders must move beyond simple access controls and implement behavioral monitoring to detect anomalous data access patterns indicative of theft or espionage.

Technical Analysis

Attack Vector: Privilege Abuse & Data Exfiltration

This incident involves the unauthorized access and potential exfiltration of sensitive patient data by an individual with internal access. While the specific tools used in the Colorado incident are still emerging, the attack chain for such breaches typically follows a consistent pattern:

Initial Access: The insider utilizes existing legitimate credentials to access the Electronic Health Record (EHR) system or file servers containing PHI.
Discovery & Aggregation: The actor queries databases or traverses network shares to identify and aggregate high-value data (e.g., SSNs, medical histories, insurance info). This often involves accessing a volume of records significantly higher than their peers or outside their specific job function (e.g., a front-desk admin accessing psychiatric evaluation records).
Exfiltration: Data is removed via non-standard channels. In healthcare environments, this is frequently achieved by:
- Mass downloading files to local removable media (USB).
- Uploading to unauthorized cloud storage or personal email.
- Printing records to non-secure printers.

Affected Assets:

EHR Databases (SQL-based repositories)
File Servers (NAS/SAN) storing unstructured PHI (PDFs, DICOM images, Word docs)
Endpoints (Clinician workstations, Admin terminals)

Exploitation Status: Confirmed active exploitation. This is not a theoretical vulnerability; it is an active abuse of business logic and access controls.

Detection & Response

Detecting insider threats requires focusing on behavior rather than just signatures. Defenders should hunt for users accessing an unusually high volume of files or accessing sensitive data types inconsistent with their role.

YAML

---
title: Potential Mass Access of Sensitive Healthcare Files
id: 9a2f1e8b-4c3d-4e5f-8a9b-1c2d3e4f5a6b
status: experimental
description: Detects a single process accessing a high volume of potential PHI file extensions (PDF, DOCX, XLSX) in a short timeframe, indicative of data scraping or staging for exfiltration.
author: Security Arsenal
date: 2026/04/06
references:
  - https://attack.mitre.org/techniques/T1005/
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '.pdf'
      - '.doc'
      - '.docx'
      - '.xls'
      - '.xlsx'
  filter:
    Image|contains:
      - '\Program Files\'
      - '\Windows\'
  condition: selection | count(TargetFilename) > 50 by Image, User within 5m
falsepositives:
  - Legitimate bulk printing or archiving by administrative staff
  - Antivirus scans
level: high
---
title: Data Exfiltration to Removable Media
id: b4c5d6e7-f8a9-4b3c-2d1e-0f9a8b7c6d5e
status: experimental
description: Detects large volume of data written to USB removable drives, a common vector for insider data theft.
author: Security Arsenal
date: 2026/04/06
references:
  - https://attack.mitre.org/techniques/T1052/
tags:
  - attack.exfiltration
  - attack.t1052
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains: ':\\'
    Image|endswith: 'explorer.exe'
  condition: selection | count(TargetFilename) > 10 by Image, TargetFilename within 1m
falsepositives:
  - Users backing up work documents to personal drives
level: medium


**KQL (Microsoft Sentinel / Defender)**

This query hunts for users accessing a high volume of potential PHI files, helping identify the "aggregation" stage of an insider attack.

KQL — Microsoft Sentinel / Defender

DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileAccessed" or ActionType == "FileOpened"
| where FileName has_any (".pdf", ".docx", ".xlsx", ".eml", ".hl7")
| summarize AccessedFilesCount = dcount(FileName), AccessedFiles = makeset(FileName) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where AccessedFilesCount > 30
| project DeviceName, User=InitiatingProcessAccountName, AccessedFilesCount, Timestamp, SampleFiles=AccessedFiles
| order by AccessedFilesCount desc


**Velociraptor VQL**

Hunt for recently accessed documents containing medical keywords on endpoints, which may indicate data staging.

VQL — Velociraptor

-- Hunt for recently accessed documents with medical keywords
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='/**/*.pdf', root='C:\Users\')
WHERE Atime > now() - 24h
   OR Mtime > now() - 24h
LIMIT 100


**Remediation Script (PowerShell)**

Run this script on affected workstations or servers to identify users with excessive local admin rights or to audit recent USB storage activity for forensics.

PowerShell

# Audit for local administrator group members (Privilege Review)
$LocalAdminGroup = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue

if ($LocalAdminGroup) {
    Write-Host "[+] Current Local Administrators:" -ForegroundColor Yellow
    $LocalAdminGroup | Select-Object Name, SID, PrincipalSource | Format-Table -AutoSize
} else {
    Write-Host "[-] No local administrators found or access denied." -ForegroundColor Red
}

# Check for recent USB drive usage (Forensic Artifact)
Write-Host "\n[+] Checking System Event Log for USB Device connection (PnP) in last 7 days..." -ForegroundColor Cyan
$UsbEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ID=2003, 2004; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue

if ($UsbEvents) {
    $UsbEvents | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "[-] No recent USB plug-and-play events found." -ForegroundColor Gray
}

Remediation

Immediate containment and long-term hardening are required to mitigate the impact of this insider breach:

Account Isolation: Immediately suspend the accounts of the suspected insider. If termination is pending, revoke all access tokens and force password changes for shared service accounts the individual may have utilized.
Data Forensics: Preserve disk images and memory dumps of the subject's workstation. Do not reboot the machine if volatile data collection is required. Analyze browser history, USB logs, and recent file access to determine the scope of the breach (Specific Patient IDs accessed).
Access Control Review (ACR): Conduct an immediate audit of Role-Based Access Control (RBAC). Ensure users have access only to the specific PHI records necessary for their daily duties (Least Privilege). Implement "Need-to-Know" verification for sensitive behavioral health records.
Implement UEBA: Deploy User and Entity Behavior Analytics (UEBA) tools to baseline normal user activity. Alert on deviations such as logins at unusual hours, bulk data exports, or access to records of patients not assigned to the user's care unit.
DLP Enforcement: Ensure Data Loss Prevention (DLP) policies are active and strictly blocking uploads of PHI to personal cloud storage or USB drives without encryption and explicit approval.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub