Park Dental & Wabi Sabi Breaches: Defending Healthcare HR Data from Exfiltration

---
title: Potential HR Data Exfiltration via Compression
id: 8c4d9f21-6b3a-4e5d-8f1e-9a2b3c4d5e6f
status: experimental
description: Detects the use of compression utilities (WinRAR, 7-Zip) on directories typically housing HR/Employee data. This is a common precursor to data exfiltration in non-ransomware breaches.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\\winrar.exe'
      - '\\7z.exe'
      - '\\winzip.exe'
      - '\	ar.exe'
  selection_keywords:
    CommandLine|contains:
      - 'employee'
      - 'payroll'
      - 'personnel'
      - 'hr'
      - 'w-2'
      - 'w2'
  condition: all of selection_*
falsepositives:
  - Legitimate HR department backups (rarely done via interactive CLI tools)
level: high
---
title: Unusual Access to HRIS Web Applications
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Identifies successful logins to HR-related web applications from anomalous locations or devices, suggesting compromised credentials.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.initial_access
  - attack.t1078.001
logsource:
  category: authentication
  product: azuread
detection:
  selection_app:
    AppDisplayName|contains:
      - 'Workday'
      - 'ADP'
      - 'Paychex'
      - 'UltiPro'
  selection_risk:
    RiskLevelDuringSignIn: 'high'
  selection_result:
    ResultType: '0'
  condition: all of selection_*
falsepositives:
  - Executive travel (should be pre-registered in travel policies)
level: medium
---
title: Mass File Access via PowerShell
id: b2c3d4e5-f6a7-4b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell scripts recursively accessing file shares, a technique often used to enumerate and stage employee data for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:\    Image|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - 'Get-Content'
    CommandLine|contains:
      - '-Recurse'
      - '-Depth'
  filter:
    ParentImage|contains:
      - '\\System32\'
      - '\\Program Files\'
  condition: selection and not filter
falsepositives:
  - System administration scripts
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for mass file access events on HR file shares
// This queries for 4660 (Handle Accessed) or 4663 (Object Access) indicating a user touching many files quickly
let HRShares = @\"\\\FileServer\\HR\", \"\\\FileServer\\Payroll\";
DeviceFileEvents
| where FolderPath has_any (HRShares)
| summarize count() by InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 5m)
| where count_ > 50 // Threshold tuning required for environment
| project Timestamp, InitiatingProcessAccountName, InitiatingProcessFileName, count_
| order by count_ desc
| extend AlertDetail = \"High volume file access detected on HR share\"


**Velociraptor VQL**

-- Hunt for zip or rar archives created in common HR directories within the last 7 days
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs=\"/*\", root=packets=\"C:/Users/*/Downloads\")
WHERE Mtime > now() - 7d
   AND (Name =~ '.zip' OR Name =~ '.rar' OR Name =~ '.7z')

-- Cross-reference with access to HR folders on the same endpoint
LET HRProcesses = SELECT Pid, Name
FROM pslist()
WHERE CommandLine =~ 'HR' OR CommandLine =~ 'Payroll'

SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Pid IN HRProcesses.Pid


**Remediation Script (PowerShell)**

# Audit permissions on critical HR directories to ensure stale access is revoked
# Run as Administrator

$HRPaths = @(\"C:\\HR_Shared\", \"C:\\Payroll_Data\", \"\\\FileServer\\HR\")
$Report = @()

foreach ($Path in $HRPaths) {
    if (Test-Path $Path) {
        $Acl = Get-Acl -Path $Path
        foreach ($Access in $Acl.Access) {
            # Flag non-inherited permissions that are not standard admin groups
            if (-not $Access.IsInherited -and $Access.IdentityReference -notmatch \"^(BUILTIN|NT AUTHORITY)\\\") {
                $Report += [PSCustomObject]@{
                    Path        = $Path
                    User        = $Access.IdentityReference
                    Rights      = $Access.FileSystemRights
                    AccessType  = $Access.AccessControlType
                    Inherited   = $Access.IsInherited
                }
            }
        }
    } else {
        Write-Warning \"Path not found: $Path\"
    }
}

# Output findings
if ($Report) {
    $Report | Format-Table -AutoSize
    # Export to CSV for review
    $Report | Export-Csv -Path \"C:\\Temp\\HR_Permissions_Audit.csv\" -NoTypeInformation
    Write-Host \"Non-standard permissions found. Review C:\\Temp\\HR_Permissions_Audit.csv\"
} else {
    Write-Host \"No non-standard explicit permissions found on monitored paths.\"
}