Unlimited Technology Systems Breach: 3.8 Million Healthcare Records Exfiltrated From Commercial Data Center — Detection and Hardening Guide

---
title: Archive Utility Execution on Server Systems - Potential Data Staging
id: 3f8a2c91-7b4e-4d1a-9c55-8e2f6a0b1d34
status: experimental
description: Detects execution of archive/compression utilities with command lines consistent with bulk data staging on Windows server systems, a common precursor to exfiltration in data center intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://securityaffairs.com/196843/data-breach/unlimited-technology-systems-data-breach-exposes-data-of-3-8-million-healthcare-patients.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - ' -p'
  filter_backup_paths:
    CommandLine|contains:
      - '\backup\'
      - '\veeam\'
      - '\sccm\'
  condition: selection_img and selection_cli and not filter_backup_paths
falsepositives:
  - Legitimate backup and software packaging operations; baseline per-server and alert on deviation
level: high
---
title: Rclone or Cloud Exfiltration Tool Execution
id: 9c1d5e47-2a8f-4b36-8d70-4f3a9b5c2e81
status: experimental
description: Detects execution of Rclone or similar cloud sync tooling frequently abused for bulk data exfiltration to attacker-controlled storage, as seen in healthcare data theft intrusions.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://securityaffairs.com/196843/data-breach/unlimited-technology-systems-data-breach-exposes-data-of-3-8-million-healthcare-patients.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAcmd.exe'
  selection_name:
    OriginalFileName:
      - 'rclone.exe'
  condition: selection_img or selection_name
falsepositives:
  - Approved cloud backup tooling using rclone; restrict to an allowlist of service accounts and paths
level: high
---
title: Mass Outbound Data Transfer From Server Segment
id: 5b7e3f09-1c6a-4d82-9e14-7c8a5d0f3b62
status: experimental
description: Detects unusually large outbound network connections from database or file server systems to non-corporate destinations, indicative of bulk data exfiltration from a data center environment.
references:
  - https://attack.mitre.org/techniques/T1041/
  - https://securityaffairs.com/196843/data-breach/unlimited-technology-systems-data-breach-exposes-data-of-3-8-million-healthcare-patients.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp|cidr:
      - '0.0.0.0/0'
    Initiated: 'true'
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_services:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.windowsupdate.com'
      - '.digicert.com'
  condition: selection and not filter_rfc1918 and not filter_known_services
falsepositives:
  - Cloud replication and SaaS integrations; pair with byte-volume aggregation in your SIEM and alert on per-host daily egress exceeding baseline
level: medium

// Hunt: Servers with abnormal daily egress volume (potential bulk exfiltration)
// Baseline per-device outbound bytes over 7 days, flag hosts exceeding 3x their median
let Lookback = 7d;
let EgressData =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "ConnectionSuccess"
    | extend RemoteIPType = iff(ipv4_is_private(RemoteIP), "private", "public")
    | where RemoteIPType == "public"
    | summarize DailyBytes = sum(BytesSent) by DeviceName, bin(TimeGenerated, 1d);
let Baseline =
    EgressData
    | summarize MedianDailyBytes = percentile(DailyBytes, 50) by DeviceName;
EgressData
| join kind=inner Baseline on DeviceName
| where DailyBytes > MedianDailyBytes * 3 and DailyBytes > 10GB
| project TimeGenerated, DeviceName, DailyBytes, MedianDailyBytes
| order by DailyBytes desc;

// Hunt: Execution of exfiltration tooling on server operating systems
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "7z.exe", "7za.exe", "rar.exe", "winscp.exe", "filezilla.exe")
   or ProcessCommandLine has_any ("rclone", "mega.nz", "copy --", "sync --")
| where DeviceName has_any ("srv", "db", "sql", "fs", "dc") // scope to server naming convention
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt: New outbound destinations never seen before from server segments (30-day first-seen)
let KnownDest =
    DeviceNetworkEvents
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where ActionType == "ConnectionSuccess"
    | summarize by RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(1d)
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| where RemoteIP !in (KnownDest)
| summarize Connections = count(), BytesSent = sum(BytesSent), Processes = make_set(FileName) by DeviceName, RemoteIP, RemoteUrl
| where BytesSent > 100MB
| order by BytesSent desc;

-- Hunt: exfiltration tooling and archive staging artifacts on endpoints
-- Scope: run against server collections during IR or proactive healthcare environment sweeps
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(rclone|megacmd|7z|7za|rar|winrar|winscp|filezilla)'
   OR CommandLine =~ '(?i)(rclone|mega\.nz|--password|-p[A-Za-z0-9])'

-- Correlate with large recently-modified archives in common staging directories
SELECT FullPath,
       Size,
       Mtime,
       Btime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.zip',
                 'C:/Users/*/AppData/Local/Temp/*.rar',
                 'C:/Users/*/AppData/Local/Temp/*.7z',
                 'C:/ProgramData/*.zip',
                 'C:/ProgramData/*.rar',
                 'C:/ProgramData/*.7z',
                 'C:/Windows/Temp/*.7z'])
WHERE Size > 50000000
  AND Mtime > now() - 1209600
ORDER BY Mtime DESC

# Unlimited Technology Systems-style breach: server egress audit and exfil-tool hardening
# Run on data center jump hosts / management servers, or deploy via GPO/Intune to server OUs

# 1. Inventory installed/running exfiltration tooling across the local system
$suspectTools = @('rclone','megacmd','winscp','filezilla','psftp','curl')
Get-Process | Where-Object { $_.Name -in $suspectTools } |
  Select-Object Name, Id, Path, StartTime | Format-Table -AutoSize

# 2. Review outbound connections from server processes over the last boot session
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.|169\.254\.)' } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      RemoteIP  = $_.RemoteAddress
      RemotePort= $_.RemotePort
      Process   = $proc.Name
      ProcPath  = $proc.Path
    }
  } | Sort-Object Process -Unique | Format-Table -AutoSize

# 3. Hunt recent archive staging in common drop locations (last 14 days, >50MB)
$cutoff = (Get-Date).AddDays(-14)
$paths = @("$env:TEMP", 'C:\ProgramData', 'C:\Windows\Temp')
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 50MB -and $_.LastWriteTime -gt $cutoff } |
    Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}}, LastWriteTime
}

# 4. Verify Windows Defender Firewall egress logging is enabled on server profile
Get-NetFirewallProfile -Profile Domain,Private |
  Select-Object Name, LogAllowed, LogBlocked, LogFileName | Format-Table -AutoSize

# 5. Enable outbound connection auditing (Success + Failure) for exfil detection pipelines
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
auditpol /get /subcategory:"Filtering Platform Connection"