NYC Health + Hospitals Supply Chain Breach: Third-Party Compromise and Data Exfiltration Detection

---
title: Vendor Account Access Outside Business Hours
id: 8a5c2d19-4e7b-4f8a-9c1d-3e6f5a7b8c9d
status: experimental
description: Detects logons from vendor-specific accounts during unusual hours (e.g., outside 08:00-18:00). Attackers often utilize compromised credentials during off-peak times to avoid detection by staff.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.valid_accounts
  - attack.t1078.004
logsource:
  category: authentication
  product: windows
detection:
  selection_vendor:
    TargetUserName|contains:
      - '_vendor'
      - '_admin'
      - '_support'
  selection_time:
    EventID: 4624
    TimeCreated:
      - betweent:
          - '00:00:00'
          - '07:00:00'
      - betweent:
          - '19:00:00'
          - '23:59:59'
  condition: all of selection_*
falsepositives:
  - Legitimate emergency maintenance by vendors
level: medium
---
title: Sensitive Folder Access by Non-Standard Process
id: 1b2e3f4a-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects access to directories commonly containing biometric or PHI data by processes other than the main EHR application or authorized backup tools.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection_target:
    TargetFileName|contains:
      - '\Biometrics'
      - '\Patients\'
      - '\Diagnoses\'
      - '\Financial\'
  selection_process:
    Image|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\python.exe'
  filter_legit:
    Image|contains:
      - '\EHR_App\'
      - '\BackupService\'
  condition: selection_target and selection_process and not filter_legit
falsepositives:
  - Administrators investigating file permissions
level: high
---
title: Large Volume Data Egress via Terminal Sessions
id: 9c0d8e7f-6a5b-4c3d-2e1f-0a9b8c7d6e5f
status: experimental
description: Detects potential data staging or exfiltration via clipboard redirection or drive mapping over RDP, common in vendor-supplied remote support.
references:
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rdpclip.exe'
    ParentImage|endswith: '\svchost.exe'
  context:
    NewProcessName|contains: 'rdpclip'
  condition: selection and context
falsepositives:
  - Legitimate copy-paste operations by remote admins
level: low

let VendorAccounts = dynamic(["VendorUser1", "VendorUser2", "_admin", "_support"]);
let SensitiveResources = dynamic(["Biometrics_DB", "Patient_Diagnoses", "Billing_System"]);
SecurityEvent
| where EventID == 4663 // Object Access
| where TargetUserName has_any (VendorAccounts)
| extend ObjectName = tostring(TargetObjectName)
| where ObjectName has_any (SensitiveResources) 
| extend AccessMask = iff(AccessMask == "0x10080", "ReadControl/ReadData", AccessMask) // Simplified mask check
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), AccessCount = count(), ObjectSet = make_set(ObjectName) by TargetUserName, SubjectUserName, Computer
| where AccessCount > 100 // Threshold for bulk access
| order by AccessCount desc

-- Hunt for archiving processes in sensitive directories
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name IN ('winrar.exe', '7z.exe', 'powershell.exe', 'cmd.exe')
  AND (
     CommandLine =~ 'biometric' OR
     CommandLine =~ 'patient' OR
     CommandLine =~ 'diagnosis' OR
     CommandLine =~ '-Compress' OR
     CommandLine =~ 'a -tzip'
  )
-- Cross-reference with open files to confirm access to sensitive paths
JOIN (
    SELECT FullPath, Pid
    FROM handle()
    WHERE FullPath =~ '\\Patients\\' OR FullPath =~ '\\Biometric\\'
) ON Pid

# Emergency Vendor Audit and Isolation Script
# Requires Active Directory Module for Windows PowerShell

param(
    [Parameter(Mandatory=$true)]
    [string]$VendorGroupName,
    [string]$LogPath = "C:\IR\VendorAudit_$(Get-Date -Format 'yyyyMMdd').log"
)

function Write-Log {
    param([string]$message)
    Add-Content -Path $LogPath -Value "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $message"
    Write-Host $message
}

Write-Log "Starting audit for vendor group: $VendorGroupName"

# 1. Identify active sessions for vendor users
Write-Log "Checking for active sessions..."
$vendorUsers = Get-ADGroupMember -Identity $VendorGroupName | Select-Object -ExpandProperty SamAccountName

$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10 OR LogonType = 2"
$sessions = Get-WmiObject -Query $query

foreach ($user in $vendorUsers) {
    $activeSessions = Get-CimInstance -ClassName Win32_LoggedOnUser | Where-Object { $_.Antecedent -like "*$user*" }
    if ($activeSessions) {
        Write-Log "ALERT: Active session found for user: $user"
        # Optional: Logoff user forcefully (Uncomment if action is required)
        # logoff $activeSessions.LogonId
    }
}

# 2. Disable vendor accounts immediately
Write-Log "Disabling all accounts in group: $VendorGroupName"
foreach ($user in $vendorUsers) {
    try {
        Disable-ADAccount -Identity $user -ErrorAction Stop
        Write-Log "Disabled account: $user"
    } catch {
        Write-Log "ERROR disabling $user : $_"
    }
}

Write-Log "Audit complete. Review logs at $LogPath"