Mission Community Hospital $1.55M Settlement: Breach Analysis and Healthcare Defense

---
title: Potential Security Log Cleared via Wevtutil
id: 1f2c3b4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to clear Windows security event logs, a common anti-forensics technique during data breaches to hide lateral movement.
references:
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains: 'cl'
  condition: selection
falsepositives:
  - Legitimate system administration tasks (rare)
level: high
---
title: Potential Credential Dumping via RdrLeakDiag
id: 2a3f4c5d-6e7f-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the use of RdrLeakDiag.exe, a diagnostics tool often repurposed by threat actors to dump memory and extract credentials from LSASS.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\RdrLeakDiag.exe'
  condition: selection
falsepositives:
  - Legitimate debugging by system administrators
level: high
---
title: Shadow Copy Deletion via Vssadmin
id: 3b4g5h6i-7j8k-5l9m-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects commands used to delete shadow copies, often executed prior to ransomware encryption to prevent recovery of PHI and databases.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - System maintenance tasks managing storage
level: critical

// Hunt for anti-forensics and credential access processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("cl", "delete shadows", "mini", "full") 
       or (ProcessCommandLine contains "wevtutil" and ProcessCommandLine contains "cl")
       or (ProcessCommandLine contains "vssadmin" and ProcessCommandLine contains "delete")
       or (FileName in ~("RdrLeakDiag.exe", "procdump.exe", "taskmgr.exe") and ProcessCommandLine contains "lsass")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| order by Timestamp desc

-- Hunt for suspicious system administration tools
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'wevtutil.exe' 
   OR Name =~ 'vssadmin.exe'
   OR Name =~ 'wbadmin.exe'
   OR Name =~ 'RdrLeakDiag.exe'

# Audit and Harden HIPAA Logging Controls
Write-Host "[+] Auditing Windows Audit Policy Configuration..."

# Check Audit Policy for Logon, Object Access, and Privilege Use
$RequiredAudits = @(
    @{Category="Logon"; Success="Enabled"; Failure="Enabled"},
    @{Category="Object Access"; Success="Enabled"; Failure="Enabled"},
    @{Category="Privilege Use"; Success="Enabled"; Failure="Enabled"},
    @{Category="Process Tracking"; Success="Enabled"; Failure="Disabled"}
)

# Get current audit policy (requires Admin rights)
try {
    $CurrentPolicy = auditpol /get /category:* /r | ConvertFrom-Csv

    foreach ($Audit in $RequiredAudits) {
        $Status = $CurrentPolicy | Where-Object { $_."Subcategory" -eq $Audit.Category }
        
        if ($Status."Inclusion Setting" -notmatch $Audit.Success) {
            Write-Host "[!] MISCONFIGURATION: $($Audit.Category) auditing is not set to Success/Failure correctly." -ForegroundColor Yellow
            # Command to remediate (uncomment to enforce)
            # auditpol /set /subcategory:"$($Audit.Category)" /success:enable /failure:enable
        } else {
            Write-Host "[+] OK: $($Audit.Category) auditing is properly configured." -ForegroundColor Green
        }
    }
} catch {
    Write-Host "[!] Error retrieving audit policy. Ensure you are running as Administrator." -ForegroundColor Red
}

# Check Event Log Sizes (Ensure they are large enough to retain data)
Write-Host "[+] Checking Event Log Configuration..."
$LogNames = @("Security", "Application", "System")
foreach ($Log in $LogNames) {
    $LogConfig = wevtutil gl $Log
    $MaxSize = ($LogConfig | Select-String "maximumSize").ToString().Split(':')[1].Trim()
    # Convert KB to bytes for comparison (Target: 1GB minimum)
    if ([int]$MaxSize -lt 1048576) {
        Write-Host "[!] WARNING: $Log log size is $MaxSize KB. Recommended minimum is 1048576 KB (1GB)." -ForegroundColor Yellow
    } else {
        Write-Host "[+] OK: $Log log size is sufficient ($MaxSize KB)." -ForegroundColor Green
    }
}