Project Lifeline 250: Hardening Rural Hospital Cybersecurity Against 2026 Healthcare Ransomware Campaigns

---
title: Suspicious PowerShell Execution in Clinical Workstation Context
id: 9e8f4a2b-5c1d-4e3f-9a8b-2d4c6e8f1a3b
status: experimental
description: Detects PowerShell execution patterns associated with healthcare ransomware deployment, specifically targeting EHR systems and medical device interfaces.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://www.hhs.gov/sites/default/files/cybersecurity-act-405d-aligning-health-care-industry-security-approaches.pdf
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.001
  - healthcare
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - '-enc '
      - '-e '
      - 'IEX'
      - 'DownloadString'
      - 'Net.WebClient'
      - 'Start-Process'
      - 'hidden'
  filter_ehr:
    CommandLine|contains:
      - 'Epic'
      - 'Cerner'
      - 'MEDITECH'
      - 'Allscripts'
  condition: selection_img and selection_cli and not filter_ehr
falsepositives:
  - Legitimate EHR scripting and clinical automation
  - Vendor maintenance scripts
level: high
---
title: Unusual Network Communication from Medical Device VLAN
id: 3a7b9c4d-2e5f-4a1b-8c9d-6e3f5a8b2c1d
status: experimental
description: Identifies lateral movement attempts or C2 communications originating from medical device network segments (typically VLANs 10-20 or 100+ in rural facilities).
references:
  - https://attack.mitre.org/techniques/T1021/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_medical:
    SourceIp|cidr:
      - '10.10.0.0/16'
      - '10.20.0.0/16'
      - '172.16.100.0/24'
  selection_ports:
    DestinationPort:
      - 445
      - 3389
      - 22
      - 5985
      - 5986
  filter_standard:
    DestinationPort:
      - 80
      - 443
      - 53
  condition: selection_internal and selection_medical and selection_ports and not filter_standard
falsepositives:
  - Medical device management consoles
  - Vendor remote support sessions
level: critical
---
title: Mass File Encryption Activity in Healthcare Environment
id: 7d2e8f1a-4b5c-4d6e-9f1a-3b5c7e9f2a4b
status: experimental
description: Detects high-volume file modification patterns consistent with ransomware encryption targeting patient records and medical imaging systems.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection_extensions:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.crypto'
      - '.ryuk'
      - '.lockbit'
      - '.blackcat'
  selection_dicom:
    TargetFilename|contains:
      - '.dcm'
      - 'DICOM'
  timeframe: 60s
  condition: selection_extensions or selection_dicom
falsepositives:
  - Medical imaging software compression
  - Backup solutions with encryption
level: critical

// Hunt for suspicious authentication patterns targeting rural hospital VPN concentrators
// Focuses on impossible travel, password spray patterns, and legacy protocol usage
let TimeRange = 24h;
let HighRiskCountries = dynamic(["RU", "CN", "KP", "IR"]);
SigninLogs
| where TimeGenerated >= ago(TimeRange)
| where AppDisplayName contains "VPN" or AppDisplayName contains "Remote" or AppDisplayName contains "Citrix"
| where ResultType != "0" // Failed attempts
| summarize 
    FailedAttempts = count(),
    UniqueIPs = dcount(IPAddress),
    Countries = make_set(LocationDetails.countryOrRegion),
    Users = make_set(UserPrincipalName)
    by IPAddress, AppDisplayName
| where FailedAttempts > 10 or array_length(Countries) > 1
| extend RiskScore = case(
    array_length(Countries) > 2, "High",
    FailedAttempts > 50, "Medium",
    "Low"
)
| project IPAddress, AppDisplayName, FailedAttempts, UniqueIPs, Countries, RiskScore
| sort by FailedAttempts desc

// Detect lateral movement via SMB/RDP from clinical workstations to administrative servers
let ClinicalSubnets = dynamic(["10.10.0.0/16", "192.168.10.0/24"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemotePort in (3389, 445, 5985, 5986)
| where ActionType == "ConnectionSuccess"
| where LocalIPType == "Private"
| where InitiatingProcessFileName !in ("mstsc.exe", "svchost.exe", "System")
| summarize 
    ConnectionCount = count(),
    UniqueTargets = dcount(RemoteIP),
    TargetList = make_set(RemoteIP, 20)
    by DeviceName, LocalIP, InitiatingProcessFileName
| where ConnectionCount > 5
| join kind=inner (
    DeviceInfo
    | where DeviceType == "Workstation"
    | project DeviceName, OSPlatform, DeviceType
) on DeviceName
| project DeviceName, OSPlatform, InitiatingProcessFileName, ConnectionCount, UniqueTargets, TargetList
| sort by ConnectionCount desc

-- Hunt for persistence mechanisms and suspicious services in healthcare environments
-- Targets registry run keys, scheduled tasks, and service modifications common in ransomware attacks
LET PersistenceHunt = SELECT 
    Name,
    Path,
    Command,
    User,
    Key
FROM glob(
    globs="HKLM:/Software/Microsoft/Windows/CurrentVersion/Run/*",
    accessor="registry"
)
WHERE Command =~ "temp|appdata|programdata|users/public"
  AND Command !~ "Citrix|VMware|Dell|Philips|GE Healthcare|Epic|Cerner";

LET ServiceHunt = SELECT 
    Name,
    Path,
    ServiceDll,
    ImagePath,
    StartName
FROM glob(
    globs="HKLM:/SYSTEM/CurrentControlSet/Services/*",
    accessor="registry"
)
WHERE ImagePath =~ "powershell|cmd.exe|wscript|cscript|mshta|rundll32"
  AND ImagePath !~ "Windows|Microsoft|Citrix|Philips|McKesson";

LET ProcessHunt = SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE CommandLine =~ "vssadmin delete|bcdedit|wbadmin delete"
   OR (Name =~ "powershell" AND CommandLine =~ "hidden|encoded|downloadstring");

SELECT * FROM chain(
    PersistenceHunt,
    ServiceHunt,
    ProcessHunt
)

# Rural Hospital Security Hardening Script - Project Lifeline 250 Baseline
# Run as Administrator on all Windows servers and workstations
# Requires PowerShell 5.1 or later

Write-Host "Starting Rural Hospital Security Hardening..." -ForegroundColor Green

# 1. Enable Windows Defender with PUA protection and Cloud-Delivered Protection
Write-Host "Configuring Windows Defender..." -ForegroundColor Yellow
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -SubmitSamplesConsent SendAllSamples
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -DisableRealtimeMonitoring $false

# 2. Enable ASR Rules for Healthcare Environments
# Blocks common ransomware behaviors while maintaining clinical app compatibility
Write-Host "Enabling Attack Surface Reduction Rules..." -ForegroundColor Yellow
Set-MpPreference -AttackSurfaceReductionRules_Ids `n    56a863a9-875e-4185-98a7-b882c64b5ce5, `n    7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c, `n    d4f940ab-401b-4efc-aadc-ad5f3c50688a, `n    9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2, `n    be9ba2d9-53ea-4cdc-84e5-9b1eeee46550, `n    e6db77e5-3df2-4cf1-b95a-636979351e5b `n    -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled, Enabled, Enabled, Enabled

# 3. Disable legacy protocols (SMBv1, NetBIOS over TCP/IP)
Write-Host "Disabling legacy protocols..." -ForegroundColor Yellow
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\*" -Name NetbiosOptions -Value 2

# 4. Enable LSA Protection (Critical for healthcare EHR credential protection)
Write-Host "Enabling LSA Protection..." -ForegroundColor Yellow
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1

# 5. Configure Windows Firewall to block lateral movement
Write-Host "Configuring Windows Firewall..." -ForegroundColor Yellow
# Block SMB inbound from non-management subnets (adjust as needed)
New-NetFirewallRule -DisplayName "Block SMB from Clinical VLANs" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 10.10.0.0/16 -Action Block
New-NetFirewallRule -DisplayName "Block RDP from Clinical VLANs" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.10.0.0/16 -Action Block

# 6. Enable PowerShell Logging (Script Block and Module Logging)
Write-Host "Enabling PowerShell logging..." -ForegroundColor Yellow
$regPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (!(Test-Path $regPath)) { New-Item -Path $regPath -Force }
Set-ItemProperty -Path $regPath -Name "EnableScriptBlockLogging" -Value 1

$regPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
if (!(Test-Path $regPath)) { New-Item -Path $regPath -Force }
Set-ItemProperty -Path $regPath -Name "EnableModuleLogging" -Value 1

# 7. Disable Office Macros from Internet (Common healthcare attack vector)
Write-Host "Disabling Office macros from untrusted sources..." -ForegroundColor Yellow
$officeVersions = @("15.0", "16.0")
foreach ($version in $officeVersions) {
    $regPath = "HKCU:\Software\Policies\Microsoft\Office\$version\Outlook\Security"
    if (!(Test-Path $regPath)) { New-Item -Path $regPath -Force }
    Set-ItemProperty -Path $regPath -Name "BlockExtContent" -Value 1
}

# 8. Enable BitLocker (if not already enabled)
Write-Host "Checking BitLocker status..." -ForegroundColor Yellow
$bitlockerStatus = Get-BitLockerVolume -MountPoint "C:"
if ($bitlockerStatus.VolumeStatus -eq "FullyDecrypted") {
    Write-Host "BitLocker not enabled. Enable-BitLocker -MountPoint 'C:' -EncryptionMethod XtsAes256" -ForegroundColor Red
    # Uncomment to enable: Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly
}

# 9. Disable PowerShell v2 (Legacy attack vector)
Write-Host "Disabling PowerShell v2..." -ForegroundColor Yellow
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 -NoRestart -ErrorAction SilentlyContinue

# 10. Verify critical services are running
Write-Host "Verifying security services..." -ForegroundColor Yellow
$services = @("WinDefend", "Sense", "EventLog", "Wecsvc")
foreach ($service in $services) {
    $svc = Get-Service -Name $service -ErrorAction SilentlyContinue
    if ($svc -and $svc.Status -ne "Running") {
        Start-Service $service
        Write-Host "Started $service" -ForegroundColor Green
    }
}

Write-Host "Hardening complete. Reboot required for LSA Protection to take effect." -ForegroundColor Green