Minidoka Memorial Hospital Ransomware Incident — Healthcare Defense Strategies & Detection Guide

---
title: Ransomware Mass File Encryption Pattern
id: 8b4e2c1f-a5d3-4e7b-b9f1-6c2a3d4e5f6g
status: experimental
description: Detects rapid file encryption patterns consistent with ransomware behavior in healthcare environments.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2024/04/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\PACS\\'
      - '\\EHR\\'
      - '\\MedicalRecords\\'
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.locked2'
      - '.crypt'
      - '.cryptolocker'
      - '.enc'
  condition: selection
falsepositives:
  - Legitimate backup encryption processes
  - Authorized file encryption tools
level: critical
---
title: Ransomware Process Spawning PowerShell
id: 9c5f3d2g-b6e4-5f8c-c0g2-7d3b4e5f6g7h
status: experimental
description: Detects suspicious processes spawning PowerShell with encoded commands, common in ransomware delivery.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/04/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\svchost.exe'
      - '\\explorer.exe'
      - '\\notepad.exe'
      - '\\mshta.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
    Image|endswith:
      - '\\powershell.exe'
    CommandLine|contains:
      - ' -EncodedCommand '
      - ' -Enc '
      - 'FromBase64String'
      - 'IEX '
  condition: selection
falsepositives:
  - Legitimate administrative scripts
  - System management tools
level: high
---
title: Ransomware Backup Deletion Activity
id: 0d6g4e3h-c7f5-6g9d-1h3e-8e4f5g6h7i8j
status: experimental
description: Detects attempts to delete or disable backup services and files, a precursor to ransomware execution.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/04/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\vssadmin.exe'
      - '\\wbadmin.exe'
      - '\\bcdedit.exe'
      - '\\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete catalog'
      - 'delete backup'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - Legitimate backup maintenance
  - Scheduled storage cleanup
level: critical

// KQL Hunt Query for Ransomware Indicators in Healthcare Environment
// Hunt for suspicious process execution patterns associated with ransomware
let SuspiciousProcesses = dynamic(['powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'rundll32.exe', 'regsvr32.exe', 'mshta.exe']);
let EncodedCommandIndicators = dynamic(['-EncodedCommand', '-Enc', 'FromBase64String', 'IEX', 'Invoke-Expression']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (SuspiciousProcesses)
| where ProcessCommandLine has_any (EncodedCommandIndicators) 
   or ProcessCommandLine contains "Invoke-WebRequest"
   or ProcessCommandLine contains "DownloadString"
| extend FilePath =FolderPath, 
         ProcessName =FileName,
         InitiatingAccount =AccountName,
         InitiatingDevice =DeviceName
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for mass file modification indicative of encryption
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileModified" or ActionType == "FileCreated"
| where FileName endswith_cs @".encrypted" 
   or FileName endswith_cs @".locked" 
   or FileName endswith_cs @".crypt"
| summarize Count = count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where Count > 50
| project DeviceName, InitiatingProcessAccountName, Count, Timestamp
| order by Count desc

// Hunt for suspicious network connections to C2 infrastructure
DeviceNetworkEvents
| where Timestamp > ago(3d)
| where RemotePort in (443, 445, 8080, 8443)
| where InitiatingProcessFileName in~ (SuspiciousProcesses)
| where isnot(RemoteIP) and RemoteIP !startswith "192.168." and RemoteIP !startswith "10." and RemoteIP !startswith "172.16."
| summarize ConnectionCount = count(), UniqueRemoteIPs = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where ConnectionCount > 10 or UniqueRemoteIPs > 3
| project DeviceName, InitiatingProcessFileName, ConnectionCount, UniqueRemoteIPs, Timestamp
| order by ConnectionCount desc

-- Velociraptor VQL Hunt Artifact for Ransomware Indicators
-- Hunt for suspicious processes spawned from unusual parents
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, ParentPid
FROM pslist()
WHERE Name IN ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'rundll32.exe')
  AND CommandLine =~ 'EncodedCommand|FromBase64String|IEX |DownloadString'
  AND ParentPid NOT IN (1, 2, 3, 4)

-- Hunt for recently created encrypted files
SELECT FullPath, Size, Mode.Mtime, Mode.Atime, Mode.Ctime
FROM glob(globs='/*/*.encrypted', accessor='auto')
WHERE Mode.Mtime > now() - 24h

-- Hunt for VSS shadow copy deletion commands
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name IN ('vssadmin.exe', 'wbadmin.exe', 'bcdedit.exe', 'wmic.exe')
  AND CommandLine =~ 'delete|resize shadowstorage|delete shadows'

-- Hunt for unusual network connections to non-standard ports
SELECT RemoteAddress, RemotePort, Pid, Name, State
FROM netstat()
WHERE RemotePort NOT IN (80, 443, 22, 3389, 5985, 5986)
  AND RemoteAddress NOT IN ('127.0.0.1', '::1', '0.0.0.0')
  AND RemoteAddress !~ '^192\.168\.'
  AND RemoteAddress !~ '^10\.'
  AND RemoteAddress !~ '^172\.(1[6-9]|2[0-9]|3[01])\.'

# PowerShell Remediation Script for Healthcare Ransomware Hardening
# This script checks for and implements key security controls to mitigate ransomware risk

# Function to write colored output
function Write-Status {
    param([string]$Message, [string]$Type = "Info")
    $color = switch($Type) {
        "Success" { "Green" }
        "Warning" { "Yellow" }
        "Error"   { "Red" }
        default    { "White" }
    }
    Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message" -ForegroundColor $color
}

# 1. Check and disable RDP if not required (RDP is a common ransomware entry point)
Write-Status "Checking RDP Configuration..." -Type "Info"
$rdpStatus = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections').fDenyTSConnections
if ($rdpStatus -eq 0) {
    Write-Status "WARNING: RDP is ENABLED. Consider disabling or securing it." -Type "Warning"
    # Uncomment to disable RDP:
    # Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
    # Write-Status "RDP has been disabled." -Type "Success"
} else {
    Write-Status "RDP is disabled. Good." -Type "Success"
}

# 2. Verify VSS Shadow Copy Service is running and protected
Write-Status "Checking Volume Shadow Copy Service..." -Type "Info"
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne "Running") {
    Write-Status "WARNING: VSS Service is not running. Backups may be vulnerable." -Type "Warning"
} else {
    Write-Status "VSS Service is running." -Type "Success"
}

# 3. Check for scheduled tasks with suspicious characteristics
Write-Status "Checking Scheduled Tasks for suspicious entries..." -Type "Info"
$suspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|cmd|wscript|cscript|rundll32' -and 
    $_.TaskPath -notmatch '\\Microsoft\\' -and 
    $_.TaskPath -notmatch '\\Hewlett-Packard\\' -and 
    $_.TaskPath -notmatch '\\Lenovo\\'
}
if ($suspiciousTasks) {
    Write-Status "WARNING: Found potentially suspicious scheduled tasks:" -Type "Warning"
    $suspiciousTasks | ForEach-Object {
        Write-Status "  - $($_.TaskPath + $_.TaskName)" -Type "Warning"
    }
} else {
    Write-Status "No obviously suspicious scheduled tasks found." -Type "Success"
}

# 4. Verify SMBv1 is disabled (EternalBlue protection)
Write-Status "Checking SMBv1 status..." -Type "Info"
$smbv1Feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
if ($smbv1Feature.State -eq "Enabled") {
    Write-Status "WARNING: SMBv1 is ENABLED. Vulnerable to EternalBlue." -Type "Warning"
    # Uncomment to disable SMBv1:
    # Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
    # Write-Status "SMBv1 has been disabled. Restart required." -Type "Success"
} else {
    Write-Status "SMBv1 is disabled. Good." -Type "Success"
}

# 5. Check Windows Firewall status
Write-Status "Checking Windows Firewall Profile status..." -Type "Info"
$firewallProfiles = Get-NetFirewallProfile
foreach ($profile in $firewallProfiles) {
    if ($profile.Enabled -eq $false) {
        Write-Status "WARNING: Firewall profile $($profile.Name) is DISABLED." -Type "Warning"
    } else {
        Write-Status "Firewall profile $($profile.Name) is enabled." -Type "Success"
    }
}

# 6. Verify recent Windows Updates
Write-Status "Checking Windows Update status..." -Type "Info"
$lastUpdate = (Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn
$daysSinceUpdate = (New-TimeSpan -Start $lastUpdate -End (Get-Date)).Days
if ($daysSinceUpdate -gt 30) {
    Write-Status "WARNING: Last update was $daysSinceUpdate days ago. Consider patching." -Type "Warning"
} else {
    Write-Status "Last update was $daysSinceUpdate days ago. Good." -Type "Success"
}

Write-Status "Ransomware hardening check complete." -Type "Info"