UK Healthcare Under Siege: Analyzing the Tenfold Spike in Cyber-Attacks

---
title: Suspicious PowerShell Web Request - Healthcare Alert
id: 3a1d2e4f-6789-4012-b3c4-5d6e7f8a9b0c
status: experimental
description: Detects PowerShell processes making web requests (Invoke-WebRequest/DownloadFile) often used in ransomware droppers observed in 2026 healthcare campaigns.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'IEX'
      - 'DownloadFile'
  selection_net:
    Network|contains:
      - 'http://'
      - 'https://'
  condition: all of selection_*
falsepositives:
  - System management scripts
  - Package managers (e.g., Chocolatey)
level: high
---
title: Potential Ransomware Activity - Mass File Modification
id: 8b9c0d1e-2345-5678-9a0b-cdef12345678
status: experimental
description: Detects processes rapidly modifying files in user directories, a precursor to ransomware encryption events targeting EHR backups.
references:
  - https://attack.mitre.org/techniques/T1486
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Users\'
      - '\Shared\'
  filter_legit:
    Image|contains:
      - '\Program Files\'
      - '\Windows\System32\'
  condition: selection and not filter_legit
  timeframe: 1m
  count: 10
falsepositives:
  - Bulk file updates by authorized backup software
  - Software installers
level: critical
---
title: Suspicious RDP Connection Frequency - Brute Force Indicator
id: 1122aabb-33cc-44dd-55ee-66ff77889900
status: experimental
description: Detects a high volume of RDP connection attempts from a single source, indicative of the brute-force attacks contributing to the UK healthcare surge.
references:
  - https://attack.mitre.org/techniques/T1110
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1110
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3389
    Image|endswith: '\svchost.exe'
  condition: selection
  timeframe: 2m
  count: 10
falsepositives:
  - Legitimate RDP load balancing (rare in this volume)
level: medium

let TimeWindow = 1h;
let FailedThreshold = 50;
DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where RemotePort == 3389 or RemotePort == 22 // RDP or SSH
| summarize FailedAttempts = count() by DeviceName, RemoteIP, RemoteCountry
| where FailedAttempts > FailedThreshold
| join kind=inner (
    DeviceLogonEvents
    | where Timestamp > ago(TimeWindow)
    | project LogonTime=Timestamp, AccountName, DeviceName, RemoteIP
) on DeviceName, RemoteIP
| project LogonTime, AccountName, DeviceName, RemoteIP, RemoteCountry, FailedAttempts
| order by FailedAttempts desc

-- Hunt for unsigned binaries in temp directories often used by web shells/droppers
SELECT 
  Pid, 
  Name, 
  Exe, 
  CommandLine, 
  Username, 
  Signed, 
  Hash
FROM process_listing()
WHERE Exe =~ 'C:\\Windows\\Temp\\.*'
   OR Exe =~ 'C:\\Users\\.*\\AppData\\Local\\Temp\\.*'
   AND Signed = FALSE
LIMIT 100

# Audit and Harden RDP against Brute Force - Healthcare Response
Write-Host "[+] Auditing RDP Configuration..."

# Check NLA status (Network Level Authentication should be Enabled)
$nlaStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -ErrorAction SilentlyContinue).UserAuthentication
if ($nlaStatus -eq 1) {
    Write-Host "[+] NLA is Enabled." -ForegroundColor Green
} else {
    Write-Host "[!] WARNING: NLA is DISABLED. Enabling now..." -ForegroundColor Red
    Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1
}

# Check for accounts in RDP sensitive local groups (high risk target)
Write-Host "[+] Checking for unauthorized RDP users..."
$rdpUsers = Get-LocalGroupMember -Group "Remote Desktop Users" -ErrorAction SilentlyContinue
foreach ($user in $rdpUsers) {
    Write-Host "[+] Found RDP User: $($user.Name)" -ForegroundColor Yellow
}

# Block common RDP brute force ports at firewall if strict deny list is applicable
Write-Host "[+] Reviewing Firewall Rules for RDP..."
$fwRules = Get-NetFirewallRule -DisplayName "*Remote Desktop*" | Where-Object {$_.Enabled -eq 'True'}
if ($fwRules) {
    Write-Host "[!] Active RDP Firewall Rules found. Consider restricting scope to specific subnets." -ForegroundColor Red
    $fwRules | Select-Object DisplayName, Enabled, Profile | Format-Table
}

Write-Host "[!] ACTION REQUIRED: If RDP is not essential for business continuity, disable the service immediately via Services.msc."
Write-Host "[+] Script Complete."