Texas Hearing Institute Breach: Defending ePHI Against Unauthorized Access

---
title: Potential Mass Data Staging via Robocopy
id: 8a4d9e12-7f3b-4c5a-9e1d-2f3b4c5d6e7f
status: experimental
description: Detects the use of robocopy with flags often used to mass copy data for exfiltration. While robocopy is an administrative tool, combining it with specific flags (e.g., /E, /ZB) in a short timeframe is a strong indicator of data staging.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/07/07
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\robocopy.exe'
    CommandLine|contains:
      - '/E'
      - '/ZB'
      - '/COPYALL'
  condition: selection
falsepositives:
  - Legitimate system backup operations
  - Administrative file migrations
level: high
---
title: Suspicious PowerShell Archive Creation
id: 3b2c1d0e-9f8a-4b6c-8d2e-1f3a4b5c6d7e
status: experimental
description: Detects PowerShell scripts attempting to compress multiple files into archives, a common technique used to bundle PHI before exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/07/07
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\powershell.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Compress-Archive'
      - 'System.IO.Compression.ZipFile'
  filter_legit:
    CommandLine|contains:
      - '\\Windows\System32\'
      - '\\Program Files\'
  condition: selection_img and selection_cmd and not filter_legit
falsepositives:
  - Legitimate backup scripts
level: medium

// Hunt for high volume file operations or archive creation on endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoCompanyName != "Microsoft Corporation" or ProcessVersionInfoProductName != "Microsoft Windows"
| where FileName in~ ("7z.exe", "winrar.exe", "winzip.exe", "tar.exe") or 
        (ProcessName has "powershell" and ProcessCommandLine has "Compress-Archive")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| summarize count() by DeviceName, FileName, bin(Timestamp, 5m)
| where count_ > 5
| order by count_ desc

-- Hunt for processes accessing sensitive directories commonly used for PHI storage
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'robocopy.exe'
   OR Name =~ 'powershell.exe'
   OR Name =~ 'cmd.exe'
-- Add specific checks for command lines containing archive keywords or copy operations
AND (CommandLine =~ 'Compress-Archive' 
     OR CommandLine =~ '/COPYALL' 
     OR CommandLine =~ '.zip')

<#
.SYNOPSIS
    Audits file shares for recent mass modifications (Data Staging check).
.DESCRIPTION
    Scans specified directories for files modified within the last 7 days to identify potential data staging locations.
#>

$DateCutoff = (Get-Date).AddDays(-7)
$SensitivePaths = @("C:\PatientData", "D:\EHR_Records", "\\fileserver\PHI") 

Write-Host "Starting audit for files modified after: $DateCutoff" -ForegroundColor Cyan

foreach ($Path in $SensitivePaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path..." -ForegroundColor Yellow
        try {
            Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $DateCutoff } |
            Select-Object FullName, LastWriteTime, Length, @{Name="Owner";Expression={(Get-Acl $_.FullName).Owner}} |
            Export-Csv -Path "C:\Temp\BreachAudit_$((Get-Date -Format 'yyyyMMdd')).csv" -NoTypeInformation -Append
        }
        catch {
            Write-Host "Error accessing $Path : $_" -ForegroundColor Red
        }
    }
    else {
        Write-Host "Path not found: $Path" -ForegroundColor Gray
    }
}

Write-Host "Audit complete. Results saved to C:\Temp\BreachAudit_YYYYMMDD.csv" -ForegroundColor Green