iRhythm Data Breach: Defending Third-Party Healthcare Applications Against Data Theft

---
title: Potential Data Exfiltration via High Volume Web Requests
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential data exfiltration by identifying processes generating a high volume of outbound HTTP/HTTPS connections to non-corporate IPs, indicative of web scraping or automated data theft.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: true
    DestinationPort:
      - 80
      - 443
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter | count(ProcessId) > 50
  timeframe: 5m
falsepositives:
  - Legitimate heavy web browsing or updates
level: high
---
title: Suspicious PowerShell Web Request Activity
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell processes utilizing Invoke-WebRequest or similar methods to interact with external domains, commonly used in scripts to scrape SaaS data or exfiltrate to cloud storage.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'wget'
      - 'curl'
  condition: selection
falsepositives:
  - System administration scripts
  - Software updates
level: medium

// Hunt for unusual access patterns to third-party SaaS applications
SigninLogs
| where ResultType == 0
| extend AppId = tostring(AppId)
| where AppId contains "thirdparty" or AppId contains "external" // Adjust based on known 3rd party AppIDs in your tenant
| summarize Count = count(), Locations = make_set(Location), UserAgents = make_set(UserAgent) by UserPrincipalName, AppId, bin(TimeGenerated, 1h)
| where Count > 100 // Threshold for high volume interaction
| project TimeGenerated, UserPrincipalName, AppId, Count, Locations, UserAgents
| order by Count desc

-- Hunt for processes communicating with external business platforms
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'chrome.exe' 
   OR Name =~ 'msedge.exe'
   OR Name =~ 'powershell.exe'
   OR Name =~ 'python.exe'

LET matching_connections = SELECT *
FROM netstat(pid=Pid)
WHERE RemoteAddress =~ '.*' 
   AND (RemotePort IN (443, 80))

SELECT * FROM foreach(
   query={
      SELECT Pid, Name, CommandLine, Username, RemoteAddress, RemotePort, State
      FROM matching_connections
   },
   query={
      SELECT Pid, Name, CommandLine, Username, "No Network Connection" AS RemoteAddress, 0 AS RemotePort, "N/A" AS State
      FROM scope()
   }
)

# Audit Script: Check for Indicators of Credential Theft and Scraping Tools
# Requires Administrator Privileges

Write-Host "[+] Starting Third-Party Breach Audit..." -ForegroundColor Cyan

# 1. Check for common scraping tools installed
$scrapeTools = @("python", "node", "wget", "curl")
$foundTools = @()

foreach ($tool in $scrapeTools) {
    $path = Get-Command $tool -ErrorAction SilentlyContinue
    if ($path) {
        $foundTools += $path.Source
    }
}

if ($foundTools.Count -gt 0) {
    Write-Host "[!] WARNING: Potential scraping tools found:" -ForegroundColor Red
    $foundTools | ForEach-Object { Write-Host "    - $_" }
} else {
    Write-Host "[+] No common scraping tools detected in PATH." -ForegroundColor Green
}

# 2. Check for suspicious recent PowerShell script execution
$startTime = (Get-Date).AddDays(-7)
$events = Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath "*[System[(EventID=4104) and TimeCreated[@>='$startTime']]]" -ErrorAction SilentlyContinue

if ($events) {
    Write-Host "[!] WARNING: Recent PowerShell script execution detected:" -ForegroundColor Red
    $events | Select-Object -First 5 TimeCreated, Message | Format-List
} else {
    Write-Host "[+] No recent suspicious PowerShell activity." -ForegroundColor Green
}

# 3. Audit Browser Downloads for recent executables (Common dropper)
$users = Get-ChildItem "C:\Users"
foreach ($user in $users) {
    $downloadPath = Join-Path $user.FullName "Downloads"
    if (Test-Path $downloadPath) {
        $recentDownloads = Get-ChildItem $downloadPath -File | Where-Object { $_.LastWriteTime -gt $startTime -and $_.Extension -in @('.exe', '.zip', '.js', '.ps1') }
        if ($recentDownloads) {
            Write-Host "[!] WARNING: Recent suspicious downloads in $($user.Name):" -ForegroundColor Yellow
            $recentDownloads | Select-Object Name, LastWriteTime
        }
    }
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan