Twin Cities Pain Clinic Data Breach Settlement: HIPAA Defense, Detection, and Remediation Lessons for Healthcare Security Teams

---
title: Bulk Archive Creation via Command-Line Compression Tool
id: 8f2c1a4e-5b3d-4e7a-9c21-6d8f0a1b2c3d
status: experimental
description: Detects 7-Zip or WinRAR invoked from the command line with archive creation and password protection flags, a common PHI staging behavior prior to exfiltration in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/twin-cities-pain-clinic-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
  filter_rmm:
    Image|startswith:
      - 'C:\Program Files\7-Zip\'
      - 'C:\Program Files\WinRAR\'
  condition: selection_binary and selection_args and not filter_rmm
falsepositives:
  - Legitimate backup or archival scripts — whitelist by full path and service account after baselining
level: high
---
title: Rclone or Cloud Sync Tool Execution for Data Exfiltration
id: 3b7e9f12-4a6c-4d8e-b5f2-1a9c0d3e4f5a
status: experimental
description: Detects execution of Rclone or similar cloud sync utilities frequently abused for bulk PHI exfiltration to attacker-controlled cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.hipaajournal.com/twin-cities-pain-clinic-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\gclone.exe'
  selection_cmd:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--config'
  condition: selection_img or selection_cmd
falsepositives:
  - Rare legitimate cloud backup workflows — most healthcare environments have no sanctioned Rclone use
level: critical
---
title: Microsoft Defender Tampering via PowerShell
id: 5d1a8c63-2e4b-4f9a-8d37-9b0e6c2f1a48
status: experimental
description: Detects attempts to disable Microsoft Defender real-time monitoring or add broad exclusion paths, a precursor to staging and encryption activity observed in healthcare intrusions.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.hipaajournal.com/twin-cities-pain-clinic-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'Add-MpPreference'
      - 'ExclusionPath'
      - 'DisableBehaviorMonitoring'
      - 'DisableIOAVProtection'
  filter_admin:
    CommandLine|contains:
      - 'ExclusionPath C:\Program Files\Microsoft'
  condition: selection and not filter_admin
falsepositives:
  - Software deployment tools adding scoped exclusions — review exclusion breadth; directory-root exclusions are never legitimate
level: high

// Hunt: PHI staging and exfiltration behaviors on healthcare endpoints
// Tables: DeviceProcessEvents (Defender), SecurityEvent (4688 via Sentinel)
// Lookback: 14 days — extend to 30 for initial baseline

let Lookback = 14d;
let CompressionTools = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe"]);
let ExfilTools = dynamic(["rclone.exe", "megacmd.exe", "gclone.exe", "filezilla.exe", "winscp.exe"]);

// Part 1: Compression tooling spawned by non-administrative parent processes
let Staging = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (CompressionTools)
| where ProcessCommandLine has_any (" a ", " -p", " -hp", " -v")
| where InitiatingProcessFileName !in~ ("svchost.exe", "sccm.exe", "tanium.exe")
| project StagingTime=TimeGenerated, DeviceName, StagingAccount=AccountName,
          StagingCmd=ProcessCommandLine, ParentProcess=InitiatingProcessFileName, StagingFile=FileName;

// Part 2: Exfiltration utility execution
let Exfil = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (ExfilTools)
    or ProcessCommandLine has_any ("rclone copy", "rclone move", "rclone sync")
| project ExfilTime=TimeGenerated, DeviceName, ExfilAccount=AccountName,
          ExfilCmd=ProcessCommandLine, ExfilFile=FileName;

// Part 3: Correlate staging and exfil on the same device within 48 hours
Staging
| join kind=inner Exfil on DeviceName
| where ExfilTime between (StagingTime .. StagingTime + 48h)
| project DeviceName, StagingAccount, StagingTime, StagingCmd, ExfilTime, ExfilCmd, ParentProcess
| order by StagingTime asc;

// Hunt: Outbound data volume anomaly — healthcare endpoints should not push GBs to rare destinations
// Requires Defender for Endpoint (DeviceNetworkEvents) or firewall logs via CommonSecurityLog

let Lookback = 7d;
let BaselineDestinations = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| summarize by RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIPType == "Public"
| where RemoteIP !in (BaselineDestinations)
| where RemotePort in (443, 22, 21, 990)
| summarize TotalConnections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            Ports=make_set(RemotePort), Processes=make_set(InitiatingProcessFileName)
    by DeviceName, RemoteIP, RemoteUrl
| where TotalConnections > 50
| order by TotalConnections desc;

-- Velociraptor hunt artifact: Windows.Healthcare.ExfilStagingHunt
-- Targets compression/exfil tool execution and recently created archives on endpoints
-- Deploy across the fleet; archive glob is scoped to common staging locations to limit I/O

LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(7z|7za|rar\.exe|rclone|megacmd)'
   OR Exe =~ '(?i)(rclone|7z|winrar)'

LET staged_archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/Desktop/*.7z',
  'C:/Users/*/Desktop/*.zip',
  'C:/Users/*/Documents/*.7z',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar',
  'C:/Temp/**/*.7z',
  'C:/Windows/Temp/*.7z',
  'C:/Windows/Temp/*.rar'
])
WHERE Mtime > now() - 1209600  -- modified in last 14 days
  AND Size > 10000000          -- larger than 10 MB

SELECT * FROM processes
UNION ALL
SELECT NULL AS Pid, 'STAGED_ARCHIVE' AS Name, FullPath AS CommandLine,
       format(format='%d MB', args=Size/1000000) AS Exe,
       '' AS Username, Mtime AS CreateTime
FROM staged_archives

#Requires -RunAsAdministrator
# Healthcare endpoint hardening and audit script
# Purpose: Verify Defender tamper protection, audit for staging artifacts,
#          check for unauthorized RMM/exfil tools, and confirm log forwarding.
# Run during IR scoping or as a monthly hygiene check. Review output before remediating.

$Report = @()
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm"

# --- 1. Verify Microsoft Defender Tamper Protection and real-time monitoring ---
$mp = Get-MpPreference
$mpStatus = Get-MpComputerStatus
$Report += [PSCustomObject]@{
    Check  = 'Defender Tamper Protection'
    Status = if ($mpStatus.IsTamperProtected) { 'PASS' } else { 'FAIL - Enable via Intune/Defender portal' }
    Time   = $Timestamp
}
$Report += [PSCustomObject]@{
    Check  = 'Defender Real-Time Monitoring'
    Status = if ($mp.DisableRealtimeMonitoring -eq $false) { 'PASS' } else { 'FAIL - RTM disabled; investigate immediately' }
    Time   = $Timestamp
}

# --- 2. Audit Defender exclusions for overly broad paths (attacker pre-staging indicator) ---
$broadExclusions = $mp.ExclusionPath | Where-Object { $_ -match '^[A-Z]:\$|^C:\$|Users$|ProgramData$|Temp$' }
$Report += [PSCustomObject]@{
    Check  = 'Defender Exclusion Breadth'
    Status = if ($broadExclusions) { "FAIL - Broad exclusions found: $($broadExclusions -join '; ')" } else { 'PASS' }
    Time   = $Timestamp
}

# --- 3. Hunt for unauthorized RMM and exfiltration tools ---
$suspectTools = @('rclone','megacmd','anydesk','splashtop','screenconnect','gclone','filezilla','winscp')
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $_.DisplayName } | Select-Object -ExpandProperty DisplayName
$found = $installed | Where-Object { $name = $_; $suspectTools | Where-Object { $name -match $_ } }
$Report += [PSCustomObject]@{
    Check  = 'Unauthorized RMM/Exfil Tools'
    Status = if ($found) { "REVIEW - Installed: $($found -join '; '). Confirm against approved software list." } else { 'PASS' }
    Time   = $Timestamp
}

# --- 4. Check for recently created large archives in common staging locations ---
$stagingPaths = @("$env:SystemDrive\Temp", "$env:WINDIR\Temp", "$env:ProgramData")
$archives = foreach ($p in $stagingPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.7z,*.rar -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 10MB }
    }
}
$Report += [PSCustomObject]@{
    Check  = 'Staged Archive Artifacts (14d, >10MB)'
    Status = if ($archives) { "REVIEW - $(($archives | Select-Object -ExpandProperty FullName) -join '; ')" } else { 'PASS' }
    Time   = $Timestamp
}

# --- 5. Verify Sysmon/forwarded log health (detection depends on telemetry) ---
$sysmon = Get-Service -Name Sysmon64 -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{
    Check  = 'Sysmon Service'
    Status = if ($sysmon -and $sysmon.Status -eq 'Running') { 'PASS' } else { 'WARN - Sysmon not running; process_creation telemetry gap' }
    Time   = $Timestamp
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\HealthSecAudit_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation