Premier Medical Group Breach Exposes 280,000 Patient Records: Detection and Hardening Guide for Healthcare Defenders

---
title: Bulk Archive Creation of Potential PHI Data
tid: 9c2f1a84-3b7d-4e51-9f2a-6d8c4b1e7a90
status: experimental
description: Detects execution of archiving utilities with command-line patterns consistent with bulk collection of file shares or directories commonly containing exported patient records, a hallmark of pre-exfiltration staging in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.securityweek.com/280000-impacted-by-premier-medical-group-data-breach/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_archiver:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' -r'
  selection_paths:
    CommandLine|contains:
      - '\Patients'
      - '\Records'
      - '\Exports'
      - '\Scans'
      - '\HIM'
      - '\Billing'
      - '.csv'
      - '.pdf'
      - '\\'
  condition: selection_archiver and selection_cmd and selection_paths
falsepositives:
  - Health Information Management staff legitimately packaging records for release-of-information requests
  - Backup software invoking 7-Zip (typically runs as SYSTEM from known paths — whitelist accordingly)
level: high
---
title: Rclone or Cloud Sync Tool Execution on Servers
tid: 4e8b2c19-6f3a-4d27-b5e1-2a9c7d4f8b36
status: experimental
description: Detects execution of Rclone or similar cloud sync utilities frequently abused for bulk PHI exfiltration to attacker-controlled cloud storage. Rarely legitimate on clinical or file servers.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.securityweek.com/280000-impacted-by-premier-medical-group-data-breach/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  filter_legit_paths:
    Image|startswith:
      - 'C:\Program Files\BackupVendor\'
  condition: selection_img and not filter_legit_paths
falsepositives:
  - Legitimate offsite backup or file-transfer tooling — maintain an explicit allowlist of sanctioned transfer utilities and their install paths
level: high
---
title: Mass File Access by a Single Account on PHI File Shares
tid: 7d1a5e42-8c4b-4f63-a2d9-5e7b3c6f1a48
status: experimental
description: Detects a single user account reading an abnormally high number of distinct files on servers hosting patient records within a short window, indicative of bulk collection prior to exfiltration. Requires SACL-based File System auditing (4663) on PHI shares.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://www.securityweek.com/280000-impacted-by-premier-medical-group-data-breach/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: file_event
  product: windows
detection:
  selection:
    ObjectServer: 'Security'
    AccessMask|contains:
      - '0x1'   # ReadData
      - '0x80'  # ReadAttributes
  condition: selection
falsepositives:
  - Indexing services, antivirus scans, DLP agents, and backup accounts — filter known service accounts and tune the aggregation threshold (recommend >500 distinct files per account per hour as a starting point)
level: medium

let Lookback = 7d;
let SuspiciousArchivers = dynamic(["7z.exe","7za.exe","rar.exe","winrar.exe","rclone.exe","megacmd.exe","winscp.exe","filezilla.exe"]);
let StagingHosts =
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ (SuspiciousArchivers)
| where ProcessCommandLine has_any ("Patients","Records","Exports","Scans","HIM","Billing",".csv",".pdf")
   or ProcessCommandLine has_all ("rclone", "copy")
| summarize ArchiveCmds = make_set(ProcessCommandLine, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessAccountName;
StagingHosts
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(Lookback)
    | where RemoteUrl has_any ("mega.nz","dropbox.com","file.io","transfer.sh","temp.sh","anonfiles")
       or (RemoteIPType == "Public" and ActionType == "ConnectionSuccess")
    | summarize OutboundConns = count(), DistinctRemoteIPs = dcount(RemoteIP), RemoteTargets = make_set(strcat(RemoteIP, "|", RemoteUrl), 15)
        by DeviceName
    | where OutboundConns > 50
) on DeviceName
| project DeviceName, InitiatingProcessAccountName, FirstSeen, LastSeen, ArchiveCmds, OutboundConns, DistinctRemoteIPs, RemoteTargets
| order by OutboundConns desc

let PatientDataServers = dynamic(["FILESRV01","EHR-DB01"]);  // replace with your PHI-bearing hosts
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4624 and LogonType in (3, 10)
| where Computer in~ (PatientDataServers)
| where Account !endswith "$"
| summarize LogonCount = count(), SourceIPs = make_set(IpAddress, 10), FirstSeen = min(TimeGenerated)
    by Account, Computer
| where LogonCount > 100 or array_length(SourceIPs) > 3
| order by LogonCount desc

-- Hunt: PHI staging and exfiltration tooling on servers
-- Combines process execution evidence with recent large archive artifacts

LET proc_hunt =
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(7z|7za|rar|winrar|rclone|megacmd|winscp|filezilla)'
   OR CommandLine =~ '(?i)(compress-archive|rclone\s+(copy|move|sync))'

LET archive_artifacts =
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:/Shares/**/*.zip',
    'C:/Shares/**/*.7z',
    'C:/Shares/**/*.rar',
    'C:/Users/*/AppData/Local/Temp/**/*.7z',
    'C:/ProgramData/**/*.rar'
])
WHERE Size > 10000000
  AND Mtime > now() - 604800   -- created in last 7 days

SELECT * FROM proc_hunt
UNION ALL
SELECT NULL AS Pid, 'ARCHIVE_ARTIFACT' AS Name, FullPath AS CommandLine,
       format(format='%d MB', args=Size/1048576) AS Exe,
       '' AS Username, Mtime AS CreateTime
FROM archive_artifacts

#requires -RunAsAdministrator
# Premier Medical Group breach lessons-learned audit: PHI share hardening verification
# Run on each file server hosting patient data. Read-only; makes no changes.

$Report = @()
$PhiShares = Get-SmbShare | Where-Object { $_.Path -match 'Patients|Records|HIM|Billing|Exports' }

# 1. Verify Object Access (File System) auditing is enabled
$auditPol = auditpol /get /subcategory:"File System" 2>$null
$fsAuditOn = ($auditPol -match 'Success|Failure')
$Report += [PSCustomObject]@{
    Check   = 'File System auditing (4663) enabled'
    Status  = if ($fsAuditOn) { 'PASS' } else { 'FAIL - enable via auditpol /set /subcategory:"File System" /success:enable /failure:enable' }
}

# 2. Enumerate PHI shares with Everyone/Domain Users Full or Change access
foreach ($share in $PhiShares) {
    $acl = Get-SmbShareAccess -Name $share.Name
    $broad = $acl | Where-Object {
        ($_.AccountName -match 'Everyone|Domain Users|Authenticated Users') -and
        ($_.AccessRight -match 'Full|Change')
    }
    $Report += [PSCustomObject]@{
        Check  = "Share scope: $($share.Name) ($($share.Path))"
        Status = if ($broad) { "FAIL - broad access: $($broad.AccountName -join ', ')" } else { 'PASS' }
    }
    # Check for SACL on the underlying folder (auditing must be set on the folder itself)
    $sacl = (Get-Acl $share.Path -Audit).Audit
    $Report += [PSCustomObject]@{
        Check  = "SACL present on $($share.Path)"
        Status = if ($sacl) { 'PASS' } else { 'FAIL - apply audit ACL (ReadData) for Everyone on this folder' }
    }
}

# 3. Hunt for unsanctioned archive/exfiltration tooling
$sanctioned = @('C:\Program Files\7-Zip\')   # extend with your approved paths
$tools = @('7z.exe','7za.exe','rar.exe','winrar.exe','rclone.exe','megacmd.exe','winscp.exe','filezilla.exe')
$found = foreach ($drive in (Get-PSDrive -PSProvider FileSystem).Root) {
    foreach ($t in $tools) {
        Get-ChildItem -Path $drive -Filter $t -Recurse -ErrorAction SilentlyContinue -Depth 4 |
            Where-Object { $p = $_.FullName; -not ($sanctioned | Where-Object { $p.StartsWith($_) }) }
    }
}
$Report += [PSCustomObject]@{
    Check  = 'Unsanctioned archive/transfer binaries'
    Status = if ($found) { "REVIEW: $($found.FullName -join '; ')" } else { 'PASS' }
}

# 4. Confirm Defender for Endpoint / AV real-time protection is active
$av = Get-MpComputerStatus -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{
    Check  = 'Real-time protection enabled'
    Status = if ($av.RealTimeProtectionEnabled) { 'PASS' } else { 'FAIL' }
}

$Report | Format-Table -AutoSize -Wrap