Tarter Krinsky & Drogin Breach: PHI of 197,000 Exposed — Detection & Hardening Guide for Legal and Healthcare Data Environments

---
title: Suspicious Archive Creation on File Server or Document Management System
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects creation of large compressed archives using 7-Zip, WinRAR, or similar tools on systems hosting sensitive documents — a hallmark of data staging prior to exfiltration in professional services intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/data-breach-new-york-law-firm/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' u '
  filter_legitimate:
    CommandLine|contains:
      - 'backup'
      - 'archive_policy'
  condition: selection_tool and selection_args and not filter_legitimate
falsepositives:
  - Legitimate backup or archival operations by IT staff
  - Document management system native compression
level: high
---
title: Rclone or Cloud Sync Tool Execution for Data Exfiltration
id: b2c3d4e5-6f78-9012-bcde-f23456789012
status: experimental
description: Detects execution of Rclone, MEGAsync, or similar cloud synchronization tools commonly used by threat actors to exfiltrate staged data from compromised environments. These tools are rarely present in law firm environments for legitimate purposes.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.hipaajournal.com/data-breach-new-york-law-firm/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\MEGAcmd.exe'
      - '\pcloud.exe'
      - '\filen.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - '--bwlimit'
  condition: selection_img or selection_cmd
falsepositives:
  - IT-managed cloud backup solutions using Rclone (rare in legal environments)
  - Developer tooling on engineering workstations
level: critical
---
title: Bulk File Access to Document Management System Shares
id: c3d4e5f6-7890-1234-cdef-345678901234
status: experimental
description: Detects anomalous volume of file read operations targeting document management system directories (iManage, NetDocuments, Worldox) or general file shares, potentially indicating mass data collection by an unauthorized actor.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://attack.mitre.org/techniques/T1039/
  - https://www.hipaajournal.com/data-breach-new-york-law-firm/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.collection
  - attack.t1039
  - attack.t1213
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\iManage\'
      - '\NetDocuments\'
      - '\Worldox\'
      - '\WorkSite\'
      - '\DMS\'
      - '\Documents\'
  selection_extensions:
    TargetFilename|endswith:
      - '.pdf'
      - '.doc'
      - '.docx'
      - '.xls'
      - '.xlsx'
      - '.tif'
      - '.tiff'
      - '.eml'
      - '.msg'
  condition: selection_paths and selection_extensions
falsepositives:
  - Legitimate document review by legal staff
  - e-Discovery processing tools
  - Document management system indexing services
level: medium

// Hunt for PHI exfiltration patterns: mass file access → archive staging → outbound transfer
// Designed for environments where sensitive legal/healthcare documents are stored on Windows file servers

// Step 1: Identify hosts with high-volume file reads on document directories
let SensitiveFileAccess =
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FolderPath has_any ("iManage", "NetDocuments", "Worldox", "WorkSite", "DMS", "FileShare", "Documents")
    | where FileName endswith_any (".pdf", ".docx", ".doc", ".xlsx", ".xls", ".eml", ".msg")
    | where ActionType == "FileCreated" or ActionType == "FileModified" or ActionType == "FileRenamed"
    | summarize FileCount = count(), DistinctFiles = dcount(FileName), FirstAccess = min(TimeGenerated), LastAccess = max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName
    | where FileCount > 500
    | project DeviceName, InitiatingProcessAccountName, FileCount, FirstAccess, LastAccess;

// Step 2: Correlate with archive creation on the same host
let ArchiveCreation =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName in~ ("7z.exe", "7za.exe", "7zg.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " u ", "-p")
    | project ArchiveTime = TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName;

// Step 3: Correlate with suspicious outbound network connections (cloud storage, unusual destinations)
let SuspiciousEgress =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any ("mega.nz", "mega.co.nz", "pcloud.com", "dropbox.com", "file.io", "wetransfer.com", "transfer.sh")
       or (RemotePort in (443, 8080, 8443) and InitiatingProcessName in~ ("rclone.exe", "megasync.exe", "pcloud.exe", "7z.exe", "powershell.exe"))
    | project EgressTime = TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessName, InitiatingProcessCommandLine;

// Join all three signals — a host showing all three is a high-confidence exfiltration candidate
SensitiveFileAccess
| join kind=inner ArchiveCreation on DeviceName
| join kind=inner SuspiciousEgress on DeviceName
| project DeviceName, InitiatingProcessAccountName, FileCount, FirstAccess, LastAccess,
          ArchiveTime, ProcessCommandLine, EgressTime, RemoteUrl, RemoteIP, InitiatingProcessName
| order by FileCount desc

-- Hunt for data staging and exfiltration tooling on endpoints
-- Targets: archive utilities, cloud sync tools, and unusual process execution from non-standard paths
-- Deploy across all Windows endpoints in scope

SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    hash(path=Exe).SHA256 AS ExeHash
FROM pslist()
WHERE 
    -- Archive creation tools used for data staging
    Name =~ '(?i)(7z|7za|7zg|rar|winrar|zip)\.exe'
    -- Cloud exfiltration tools
    OR Name =~ '(?i)(rclone|megasync|pcloud|filen|MEGAcmd)\.exe'
    -- Processes running from suspicious directories (temp, appdata, programdata)
    OR (Exe =~ '(?i)(temp|tmp|appdata|programdata|public|downloads)\\\\' 
        AND Name =~ '(?i)\.(exe|dll|bat|ps1|vbs|js)$')
    -- PowerShell with encoded commands (common in post-exploitation)
    OR (Name =~ '(?i)powershell.*\.exe' AND CommandLine =~ '(?i)(-enc|-e |-ec|frombase64|invoke-expression|iex)')
ORDER BY CreateTime DESC

# ============================================================
# PHI Protection Hardening Script — Legal/Professional Services
# Targets: Windows Server 2016+ file servers hosting sensitive docs
# Run as Domain Admin / Local Admin
# ============================================================

Write-Host "=== Security Arsenal — PHI Environment Hardening ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"

# ---- 1. Enable detailed file system auditing on sensitive shares ----
Write-Host "`n[1] Configuring File System Auditing on Sensitive Directories..." -ForegroundColor Yellow

$sensitivePaths = @(
    "D:\Shares\Documents",
    "D:\Shares\DMS",
    "D:\Shares\Legal",
    "C:\Shares\FileShare"
    # Add your actual share paths here
)

foreach ($path in $sensitivePaths) {
    if (Test-Path $path) {
        # Enable auditing for Read, Write, Delete on sensitive directories
        $acl = Get-Acl -Path $path -Audit
        $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone",
            "Read,Write,Delete,Modify,ChangePermissions",
            "ContainerInherit,ObjectInherit",
            "None",
            "Success,Failure"
        )
        $acl.AddAuditRule($auditRule)
        Set-Acl -Path $path -AclObject $acl
        Write-Host "  [+] Audit policy applied to: $path" -ForegroundColor Green
    } else {
        Write-Host "  [-] Path not found (skipping): $path" -ForegroundColor DarkGray
    }
}

# Enable Object Access auditing via local policy
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
Write-Host "  [+] Object Access auditing enabled (File System, File Share, Detailed File Share)" -ForegroundColor Green


# ---- 2. Block unauthorized archiving and exfiltration tools via AppLocker ----
Write-Host "`n[2] Configuring AppLocker to Block Common Exfiltration Tools..." -ForegroundColor Yellow

$appLockerRules = @"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="a1b2c3d4-0001-4000-8000-000000000001" Name="Block Rclone" Description="Block Rclone execution" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="*\rclone.exe"/>
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="a1b2c3d4-0002-4000-8000-000000000002" Name="Block MEGAsync" Description="Block MEGAsync execution" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="*\megasync.exe"/>
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="a1b2c3d4-0003-4000-8000-000000000003" Name="Block MEGAcmd" Description="Block MEGAcmd execution" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="*\MEGAcmd.exe"/>
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>
"@

# NOTE: Start in AuditOnly mode. Change EnforcementMode to "Enabled" after testing.
$appLockerRules | Out-File -FilePath "C:\Windows\Temp\AppLocker_ExfilBlock.xml" -Force
Set-AppLockerPolicy -XmlPolicy "C:\Windows\Temp\AppLocker_ExfilBlock.xml" -Merge
Write-Host "  [+] AppLocker rules deployed in AUDIT mode — review before enforcing" -ForegroundColor Green
Write-Host "  [!] To enforce: change EnforcementMode to 'Enabled' and re-apply" -ForegroundColor Red


# ---- 3. Restrict RDP and SMB exposure ----
Write-Host "`n[3] Checking Remote Access Service Configuration..." -ForegroundColor Yellow

# Check if RDP is enabled
$rdpEnabled = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($rdpEnabled -eq 0) {
    Write-Host "  [!] RDP is ENABLED. Ensure it is NOT exposed to the internet." -ForegroundColor Red
    Write-Host "      Restrict RDP to specific management IPs via Windows Firewall:" -ForegroundColor Red
    Write-Host "      netsh advfirewall firewall set rule name='Remote Desktop - User Mode (TCP-In)' new remoteip=<management_subnet>" -ForegroundColor DarkGray
} else {
    Write-Host "  [+] RDP is disabled." -ForegroundColor Green
}

# Check SMBv1 status (should be disabled)
$smbv1 = Get-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -ErrorAction SilentlyContinue
if ($smbv1.State -eq "Enabled") {
    Write-Host "  [!] SMBv1 is ENABLED — disabling now." -ForegroundColor Red
    Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart
    Write-Host "  [+] SMBv1 disabled. Reboot required." -ForegroundColor Green
} else {
    Write-Host "  [+] SMBv1 is disabled." -ForegroundColor Green
}


# ---- 4. Verify EDR/Antivirus is running and updated ----
Write-Host "`n[4] Checking Endpoint Protection Status..." -ForegroundColor Yellow

$avStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($avStatus) {
    Write-Host "  Defender Status: AMServiceEnabled=$($avStatus.AMServiceEnabled), RealTimeProtection=$($avStatus.RealTimeProtectionEnabled)" -ForegroundColor $(if($avStatus.RealTimeProtectionEnabled){"Green"}else{"Red"})
    Write-Host "  Signature Version: $($avStatus.AntivirusSignatureVersion) | Last Updated: $($avStatus.AntivirusSignatureLastUpdated)" -ForegroundColor $(if($avStatus.AntivirusSignatureLastUpdated -gt (Get-Date).AddDays(-3)){"Green"}else{"Red"})
    
    if (-not $avStatus.RealTimeProtectionEnabled) {
        Write-Host "  [!] CRITICAL: Real-time protection is DISABLED. Enabling..." -ForegroundColor Red
        Set-MpPreference -DisableRealtimeMonitoring $false
    }
} else {
    Write-Host "  [!] Windows Defender not detected. Verify third-party EDR agent status manually." -ForegroundColor Yellow
}


# ---- 5. Check for suspicious recently installed software ----
Write-Host "`n[5] Scanning for Recently Installed Suspicious Software..." -ForegroundColor Yellow

$suspiciousTools = @("rclone", "megasync", "pcloud", "filezilla", "winscp", "anydesk", "teamviewer", "screenconnect", "splashtop")
$installed = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName } |
    Select-Object DisplayName, InstallDate, Publisher

foreach ($tool in $suspiciousTools) {
    $found = $installed | Where-Object { $_.DisplayName -match $tool }
    if ($found) {
        foreach ($f in $found) {
            Write-Host "  [!] SUSPICIOUS: $($f.DisplayName) | Installed: $($f.InstallDate) | Publisher: $($f.Publisher)" -ForegroundColor Red
        }
    }
}
Write-Host "  [+] Suspicious software scan complete. Review any flagged items above." -ForegroundColor Green


# ---- 6. Enable PowerShell Script Block Logging (critical for post-compromise forensics) ----
Write-Host "`n[6] Enabling PowerShell Script Block Logging..." -ForegroundColor Yellow

$psLogPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $psLogPath)) {
    New-Item -Path $psLogPath -Force | Out-Null
}
Set-ItemProperty -Path $psLogPath -Name "EnableScriptBlockLogging" -Value 1
Write-Host "  [+] Script Block Logging enabled." -ForegroundColor Green

$psModulePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
if (-not (Test-Path $psModulePath)) {
    New-Item -Path $psModulePath -Force | Out-Null
}
Set-ItemProperty -Path $psModulePath -Name "EnableModuleLogging" -Value 1
Write-Host "  [+] Module Logging enabled." -ForegroundColor Green


# ---- 7. Summary ----
Write-Host "`n=== Hardening Complete ===" -ForegroundColor Cyan
Write-Host "Review all [+] (applied), [!] (action needed), and [-] (skipped) items above."
Write-Host "Recommend forwarding Windows Event IDs 4663, 4656, 5140, 5145 to your SIEM."
Write-Host "Test AppLocker rules in Audit mode for minimum 2 weeks before enforcing."