Tift Regional Health System $1.2M Breach Settlement: Ransomware Defense and HIPAA Remediation Lessons for Healthcare Security Teams

---
title: Shadow Copy Deletion via Vssadmin or WMIC
id: 8f2e4b91-3c7d-4a5e-9f1b-2d6c8a4e7b90
status: experimental
description: Detects deletion of Volume Shadow Copies, a near-universal precursor to ransomware encryption observed in healthcare intrusions including attacks on regional hospital systems.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'shadowcopy delete /nointeractive'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Get-CimInstance Win32_ShadowCopy'
      - 'Remove-WmiObject'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing scripted shadow copy cleanup during maintenance windows
  - Some backup agents; baseline and allowlist known backup service accounts
level: high
---
title: Mass File Encryption Behavior via Suspicious Process Write Activity
id: 4d1a7e62-8b3f-4c9d-a2e5-7f9b1c3d6e84
status: experimental
description: Detects rapid creation of files with ransomware-style note names across clinical and file server hosts, indicating active encryption and ransom note deployment.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection_note_names:
    TargetFilename|contains:
      - 'HOW_TO_DECRYPT'
      - 'RECOVER-FILES'
      - 'DECRYPT_INFO'
      - 'RESTORE_FILES_INFO'
      - 'readme_for_unlock'
      - '!!!READ_ME!!!'
      - 'FILES ENCRYPTED'
  selection_note_ext:
    TargetFilename|endswith:
      - '.onion.txt'
      - '.onion.html'
  condition: 1 of selection_*
falsepositives:
  - Penetration testing or red team activity — validate against authorized engagement schedules
  - Anti-ransomware canary files deployed by EDR vendors; exclude known canary paths
level: critical
---
title: Security Tool Tampering via BCDEdit Recovery Disable
id: 2c9f5a71-6e4b-4d8a-b3c1-9a7e2f5d8b36
status: experimental
description: Detects use of bcdedit to disable recovery options and safe boot, a standard ransomware anti-recovery technique that precedes mass encryption on hospital workstations and servers.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.defense_evasion
  - attack.t1490
  - attack.t1562
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'recoveryenabled  no'
      - 'bootstatuspolicy ignoreallfailures'
  filter_known_admins:
    User|contains:
      - 'SCCM_Deployment'
  condition: selection and not filter_known_admins
falsepositives:
  - Rare; some imaging and deployment platforms modify boot configuration — allowlist the specific service accounts used by your imaging solution only
level: high

let TimeWindow = 1h;
let TamperProc = DeviceProcessEvents
| where TimeGenerated > ago(TimeWindow)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no",
    "bootstatuspolicy ignoreallfailures", "Win32_Shadowcopy")
| project DeviceName, AccountName, TamperCommand=ProcessCommandLine, TamperTime=TimeGenerated, TamperProc=FileName;
let RansomNotes = DeviceFileEvents
| where TimeGenerated > ago(TimeWindow)
| where FileName has_any ("HOW_TO_DECRYPT", "RECOVER-FILES", "DECRYPT_INFO", "RESTORE_FILES_INFO",
    "readme_for_unlock", "FILES ENCRYPTED")
   or FileName endswith ".onion.txt"
| summarize NoteCount = count(), NotePaths = make_set(FolderPath, 10) by DeviceName, InitiatingProcessFileName;
TamperProc
| join kind=leftouter RansomNotes on DeviceName
| project DeviceName, AccountName, TamperProc, TamperCommand, TamperTime, NoteCount, NotePaths
| order by TamperTime desc

-- Hunt for ransomware anti-recovery commands and encryption staging artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures)'
   OR Name =~ '(?i)(vssadmin|bcdedit)'

-- Companion artifact: search user-writable and share paths for ransom notes
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/Desktop/*.txt', 'C:/Users/*/Documents/*.txt',
                 'C:/ProgramData/*.txt', 'D:/Shares/**/*.txt'])
WHERE FullPath =~ '(?i)(decrypt|recover|restore_files|unlock|read.?me)'
  AND Mtime > now() - 86400*7

# Security Arsenal - Healthcare Ransomware Resilience Audit
# Run elevated on Windows servers and workstations. Outputs compliance findings.

Write-Host "=== Ransomware Resilience Audit ===" -ForegroundColor Cyan

# 1. Verify Tamper Protection status
$mp = Get-MpComputerStatus
if ($mp.IsTamperProtected) {
    Write-Host "[PASS] Defender Tamper Protection is enabled" -ForegroundColor Green
} else {
    Write-Host "[FAIL] Tamper Protection DISABLED - enable via Intune/GPO immediately" -ForegroundColor Red
}

# 2. Verify Real-time protection and cloud-delivered protection
if ($mp.RealTimeProtectionEnabled -and $mp.AMServiceEnabled) {
    Write-Host "[PASS] Real-time protection active" -ForegroundColor Green
} else {
    Write-Host "[FAIL] Real-time protection degraded - possible attacker tampering" -ForegroundColor Red
}

# 3. Check Attack Surface Reduction rules (block credential theft + ransomware behaviors)
$asrRules = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
$requiredASR = @{
    'd4f940ab-401b-4efc-aadc-ad5f3c50688a' = 'Block Office child processes'
    'be9ba2d9-53ea-4cdc-84e5-9b1eeee46550' = 'Block executable content from email'
    'c1db55ab-c21a-4637-bb3f-a12568109d35' = 'Block ransomware behavior (Controlled Folder Access precursor)'
    '56a863a9-875e-4185-98a7-b882c64b5ce5' = 'Block LSASS credential theft'
}
foreach ($rule in $requiredASR.Keys) {
    if ($asrRules -contains $rule) {
        Write-Host "[PASS] ASR rule present: $($requiredASR[$rule])" -ForegroundColor Green
    } else {
        Write-Host "[WARN] Missing ASR rule: $($requiredASR[$rule]) - configure in block mode" -ForegroundColor Yellow
    }
}

# 4. Verify VSS service is not disabled and shadow copies exist
$vss = Get-Service VSS -ErrorAction SilentlyContinue
if ($vss.StartType -ne 'Disabled') {
    Write-Host "[PASS] VSS service not disabled" -ForegroundColor Green
} else {
    Write-Host "[FAIL] VSS service disabled - investigate for attacker tampering" -ForegroundColor Red
}
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Host "[PASS] $($shadows.Count) shadow copies present" -ForegroundColor Green
} else {
    Write-Host "[WARN] No shadow copies found - verify backup strategy and shadow storage config" -ForegroundColor Yellow
}

# 5. Audit RDP exposure (common initial access vector in healthcare)
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
if ($rdp.fDenyTSConnections -eq 1) {
    Write-Host "[PASS] RDP disabled" -ForegroundColor Green
} else {
    $nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication
    if ($nla.UserAuthentication -eq 1) {
        Write-Host "[WARN] RDP enabled with NLA - restrict via firewall and require VPN/ZTNA" -ForegroundColor Yellow
    } else {
        Write-Host "[FAIL] RDP enabled WITHOUT NLA - critical exposure" -ForegroundColor Red
    }
}

# 6. Check for suspicious recently created local admin accounts
$recentAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Where-Object { $_.ObjectClass -eq 'User' }
foreach ($member in $recentAdmins) {
    $acct = Get-LocalUser -Name $member.Name.Split('\')[-1] -ErrorAction SilentlyContinue
    if ($acct -and $acct.PasswordLastSet -gt (Get-Date).AddDays(-14)) {
        Write-Host "[WARN] Recently modified local admin: $($acct.Name) - validate against change records" -ForegroundColor Yellow
    }
}

Write-Host "=== Audit Complete ===" -ForegroundColor Cyan