iRhythm Breach: Defending Against Third-Party Application Risks in Healthcare

---
title: Potential Data Exfiltration via Third-Party User Agents
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential data exfiltration by identifying processes establishing network connections with headers or user-agents often associated with third-party utilities or scripts, coupled with high outbound volume.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: true
    DestinationPort|between: 
      - 443
      - 8080
  filter_legit_traffic:
    Image|endswith:
      - '\chrome.exe'
      - '\edge.exe'
      - '\firefox.exe'
  condition: selection and not filter_legit_traffic
falsepositives:
  - Legitimate third-party software updates
  - High-volume internal sync operations
level: medium
---
title: PowerShell Base64 Encoded Web Requests
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects PowerShell processes making web requests that contain Base64 encoded commands in the URL or payload, a common technique for data theft scripts.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'WebRequest'
    CommandLine|contains: 
      - 'ToBase64String'
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Legitimate administrative scripting
level: high

// Hunt for third-party application sign-ins followed by unusual data access volumes
// Normalize timestamps and look for AppID usage spikes
SigninLogs
| where ResultType == 0
| extend AppName = AppDisplayName
| summarize count() by AppName, bin(TimeGenerated, 1h)
| join kind=inner (
    SigninLogs 
    | where ResultType == 0 
    | project AppDisplayName, UserId, UserPrincipalName, TimeGenerated
) on $left.AppName == $right.AppDisplayName, $left.TimeGenerated == $right.TimeGenerated
| where count_ > 50 // Threshold for high volume sign-in attempts
| project AppName, UserPrincipalName, TimeGenerated

-- Hunt for established network connections to non-corporate ranges
-- initiated by non-browser processes, potential data staging
SELECT Pid, Name, CommandLine, RemoteAddress, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND RemoteAddress NOT IN('127.0.0.1', '::1')
  AND Name NOT =~ '(chrome|firefox|msedge|safari)'
  AND RemotePort IN(80, 443, 8080)
  AND CommandLine =~ '(curl|wget|python|powershell)'

# Script to Audit and Revoke Risky OAuth Grants for Third-Party Apps
# Requires AzureAD or Microsoft Graph PowerShell modules

Write-Host "Starting Third-Party OAuth Audit..." -ForegroundColor Cyan

# Connect to MS Graph (Uncomment if running interactively in a fresh session)
# Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"

# Get all Service Principals (Third-party apps)
$Apps = Get-MgServicePrincipal -All

$RiskyPermissions = @("User.Read.All", "Mail.Read", "Files.Read.All", "Files.ReadWrite.All")

$Report = @()

foreach ($App in $Apps) {
    # Get OAuth2PermissionGrants for this app
    $Grants = Get-MgOauth2PermissionGrant -Filter "clientId eq '$($App.Id)'"
    
    foreach ($Grant in $Grants) {
        $Resource = Get-MgServicePrincipal -ServicePrincipalId $Grant.ResourceId
        
        # Check scope for high-risk permissions
        $Scopes = $Grant.Scope -split " "
        $MatchedScopes = $Scopes | Where-Object { $RiskyPermissions -contains $_ }
        
        if ($MatchedScopes) {
            $Report += [PSCustomObject]@{
                AppName = $App.DisplayName
                AppId = $App.AppId
                ResourceName = $Resource.DisplayName
                RiskyPermissions = $MatchedScopes -join ", "
                ConsentType = $Grant.ConsentType
                PrincipalId = $Grant.PrincipalId
            }
        }
    }
}

if ($Report.Count -gt 0) {
    Write-Host "WARNING: High-risk permissions found." -ForegroundColor Red
    $Report | Format-Table -AutoSize
    
    # Optional: Automated Revocation Logic (Proceed with caution)
    # foreach ($Entry in $Report) {
    #     Write-Host "Revoking access for $($Entry.AppName)..."
    #     # Revoke-MgOauth2PermissionGrant -OAuth2PermissionGrantId <GrantId>
    # }
} else {
    Write-Host "No high-risk third-party permissions detected." -ForegroundColor Green
}