Tennessee Pathology Group Data Breach: Detecting and Containing PHI Exfiltration

---
title: Potential Mass Data Compression for Exfiltration
id: 8a2b4c1d-9e3f-4a5b-b6c7-8d9e0f1a2b3c
status: experimental
description: Detects processes compressing large volumes of files, a common precursor to data exfiltration in healthcare breaches. Focuses on archive creation in user directories.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\tar.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'Compress-Archive'
      - '-a'
      - '.zip'
      - '.rar'
  filter_legitimate:
    ParentImage|contains:
      - '\Program Files\'
      - '\System32\'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate administrative backups
level: high
---
title: Suspicious PowerShell Web Request Activity
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects PowerShell processes making network connections, often used for data exfiltration or C2 when attackers leverage living-off-the-land binaries.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    Initiated: 'true'
  condition: selection
falsepositives:
  - Software updates or management scripts
level: medium

// Hunt for unusual data egress volumes or sign-ins from unfamiliar locations
// Context: High volume egress often indicates bulk PHI download
let HighVolumeEgress = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionInitiated"
| where RemotePort in (80, 443, 22, 21)
| summarize SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by DeviceName, RemoteUrl, RemoteIP
| where SentBytes > 50000000 // Threshold: 50MB
| project DeviceName, RemoteUrl, RemoteIP, SentBytes, Alert="High Volume Egress";

// Correlate with Logon events to see if a user is associated
let SigninRisk = SigninLogs
| where Timestamp > ago(7d)
| where ResultType == 0
| where ConditionalAccessStatus != "success"
| project UserPrincipalName, IPAddress, Location, Alert="Risk Signin";

union HighVolumeEgress, SigninRisk

-- Velociraptor Hunt: Identify recently created archives and unusual network connections
-- Targeting endpoints where patient data might be staged.

SELECT * FROM foreach(
    glob(globs="\\Users\\*\\*.zip", root="C:\\"),
    {
        SELECT Mtime AS ModifiedTime, 
               Size, 
               FullPath,
               Sys.SysPid AS ProcessId
        FROM stat(filename=_Value)
        WHERE ModifiedTime > now() - 24 * 3600  // Last 24 hours
    }
)

UNION ALL

SELECT Pid, Name, CommandLine, RemoteAddress, RemotePort
FROM netstat()
WHERE RemotePort != 0 
  AND State =~ 'ESTABLISHED'
  AND (Name =~ 'powershell.exe' OR Name =~ 'cmd.exe' OR Name =~ 'python.exe')


**Remediation Script (PowerShell):**

# Audit Script: Identify recently created compressed archives on critical servers
# Run this on suspected file servers or database backup locations to locate staged data.

$DaysToCheck = 7
$Extensions = @('*.zip', '*.rar', '*.7z', '*.tar.gz')
$CriticalPaths = @('C:\Users', 'D:\Data', 'E:\Backups') # Adjust to environment

$Results = foreach ($Path in $CriticalPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include $Extensions -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-$DaysToCheck) } |
        Select-Object FullName, LastWriteTime, Length, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}}
    }
}

if ($Results) {
    Write-Host "[!] Potential Staged Data Found:" -ForegroundColor Red
    $Results | Format-Table -AutoSize
    # Optional: Move to quarantine or flag for IR team
} else {
    Write-Host "No suspicious archives found in the last $DaysToCheck days." -ForegroundColor Green
}