Recent Healthcare Breaches: Lincare & HHS Tracker Updates — Ransomware TTPs and Defense

---
title: Potential Rclone Data Exfiltration
id: 8a1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects the use of Rclone, a command-line tool often used by threat actors to exfiltrate large volumes of data to cloud storage. Frequent in BlackSuit and other ransomware operations.
references:
  - https://www.sans.org/white-papers/finding-bad-apples-in-lodge/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
    or
    CommandLine|contains:
      - 'rclone '
      - 'sync '
      - 'copy '
      - 'config create'
  condition: selection
falsepositives:
  - Legitimate backup operations by administrators (rare in non-IT user contexts)
level: high
---
title: Suspicious PowerShell Web Request (Exfiltration)
id: 9b2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects PowerShell commands used to exfiltrate data via web requests, commonly used when dedicated tools like Rclone are not available or blocked.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'WebClient'
      - 'DownloadFile'
  filter_legit:
    ParentImage|contains:
      - '\SoftwareDistribution\Download\'
      - '\Windows\System32\svchost.exe'
  condition: selection and not filter_legit
falsepositives:
  - System updates or legitimate management scripts
level: medium
---
title: Mass File Deletion or Encryption Prep
id: 0c3d4e5f-6b7c-8d9e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects rapid deletion or modification of shadow copies using vssadmin or diskshadow, a common precursor to ransomware encryption to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\diskshadow.exe'
    CommandLine|contains:
      - 'delete shadows'
      - '/all'
      - 'resize shadowstorage'
level: high

let threshold = 50000000; // 50MB threshold
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType in ("ConnectionAccepted", "ConnectionSuccess")
| where RemotePort in (443, 80) // Web traffic commonly used for exfil
| where InitiatingProcessFileName !in ("chrome.exe", "edge.exe", "firefox.exe", "msedge.exe", "teams.exe", "outlook.exe") // Filter common browsers/apps
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl
| where TotalBytesSent > threshold
| project DeviceName, Account = InitiatingProcessAccountName, Process = InitiatingProcessFileName, Destination = RemoteUrl, TotalBytesSent
| order by TotalBytesSent desc

-- Hunt for ransomware precursor processes and exfil tools
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'rclone'
   OR Name =~ 'vssadmin'
   OR Name =~ 'wbadmin'
   OR Name =~ 'bcdedit'
   OR CommandLine =~ 'delete.*shadows'
   OR CommandLine =~ 'resize.*shadowstorage'

# HealthCare-Breach-Audit.ps1
# Usage: Run as Administrator or via SCCM/Intune

Write-Host "[+] Starting Healthcare Breach Audit..." -ForegroundColor Cyan

# 1. Check for common exfil tools (Rclone)
Write-Host "[*] Checking for Rclone presence..." -ForegroundColor Yellow
$rclonePaths = @(
    "C:\Windows\System32\rclone.exe",
    "C:\Users\*\AppData\Local\rclone.exe",
    "C:\Temp\rclone.exe"
)

foreach ($path in $rclonePaths) {
    if (Test-Path $path) {
        Write-Host "[!] ALERT: Rclone found at $path" -ForegroundColor Red
    }
}

# 2. Check for common Ransomware Note patterns in user directories
Write-Host "[*] Checking for Ransomware Note patterns..." -ForegroundColor Yellow
$users = Get-ChildItem "C:\Users" -Directory
$notePatterns = @("*.locked", "*README*.txt", "*RECOVER*.txt", "*DECRYPT*.html", "*HOW_TO*.txt")

foreach ($user in $users) {
    foreach ($pattern in $notePatterns) {
        $notes = Get-ChildItem -Path "C:\Users\$($user.Name)" -Filter $pattern -Recurse -ErrorAction SilentlyContinue
        if ($notes) {
            foreach ($note in $notes) {
                Write-Host "[!] ALERT: Potential ransom note found: $($note.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 3. Audit Shadow Copy Storage Status
Write-Host "[*] Checking Shadow Copy Storage..." -ForegroundColor Yellow
try {
    $shadow = vssadmin list shadowstorage
    if ($shadow -match "No shadow copies") {
        Write-Host "[!] WARNING: No shadow copies found on this system." -ForegroundColor Red
    } else {
        Write-Host "[+] Shadow copies present." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Could not query shadow storage." -ForegroundColor Gray
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan