UNM Health Cyberattack: Defending Hospital Networks Against Operational Disruption

---
title: Mass File Encryption on Clinical Workstations
id: 8a9b0c1d-2e3f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious file modification patterns consistent with ransomware encryption targeting clinical data shares.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\vssadmin.exe'
    TargetFilename|contains:
      - '.encrypted'
      - '.locked'
      - '.crypt'
      - 'DECRYPT_INSTRUCTIONS'
      - 'README_FOR_DECRYPT'
  filter:
    Image|endswith: '\backup.exe'
condition: selection and not filter
falsepositives:
  - Legitimate backup software operations
level: high
---
title: Suspicious Admin Share Access in Clinical VLAN
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects lateral movement attempts via ADMIN$ or C$ shares from non-management systems to clinical workstations or servers.
references:
  - https://attack.mitre.org/techniques/T1021.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    Image|endswith:
      - '\psexec.exe'
      - '\wmiexec.exe'
      - '\at.exe'
      - '\schtasks.exe'
    DestinationIp|startswith:
      - '10.10.'  # Example clinical VLAN
      - '192.168.100.'  # Example medical device VLAN
  filter:
    SourceIp|startswith: '10.1.1.'  # IT management subnet
condition: selection and not filter
falsepositives:
  - Legitimate administrative activity from management VLANs
level: high
---
title: Volume Shadow Copy Deletion Attempt
id: 6e5d4c3b-2a1f-9e8d-7c6b-5a4f3e2d1c0b
status: experimental
description: Detects deletion of volume shadow copies often performed by ransomware prior to encryption to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin delete shadows /all'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
falsepositives:
  - Legitimate backup maintenance scripts
level: critical

// Hunt for lateral movement and encryption preparation in healthcare environments
let ClinicalVLANs = dynamic(["10.10.", "192.168.100."]);
let timeframe = 24h;

// Detect suspicious SMB enumeration from clinical workstations
DeviceNetworkEvents
| where Timestamp > ago(timeframe)
| where RemotePort == 445
| where RemoteIP has_any (ClinicalVLANs)
| where InitiatingProcessFileName in~ ("psexec.exe", "wmic.exe", "powershell.exe", "rundll32.exe")
| where not(InitiatingProcessFolderPath has_any ("c:\\windows\\system32", "c:\\windows\\syswow64"))
| summarize Connections = count(), UniqueTargets = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where UniqueTargets > 5
| sort by UniqueTargets desc;

// Detect mass file modifications indicative of encryption
DeviceFileEvents
| where Timestamp > ago(timeframe)
| where FileName has_any (".encrypted", ".locked", "DECRYPT", "README")
| summarize FileMods = count() by DeviceName, FolderPath, InitiatingProcessFileName
| where FileMods > 50
| sort by FileMods desc;

// Detect shadow copy deletion attempts
DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where ProcessCommandLine has_any ("vssadmin delete", "wmic shadowcopy delete", "bcdedit /set")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

-- Hunt for ransomware precursors and lateral movement artifacts in healthcare environments
-- Target clinical workstations and servers for suspicious process execution

-- Detect suspicious SMB admin share access patterns
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Netstat.RemoteAddress, Netstat.RemotePort
FROM pslist()
WHERE (CommandLine =~ 'psexec|wmiexec|wmic.*node' 
   OR Name =~ 'vssadmin|bcdedit|diskshadow')
   AND (Netstat.RemotePort == 445 OR Netstat.RemotePort == 3389)

-- Hunt for mass file modifications in user directories (encryption activity)
LET EncryptionHunt = SELECT FullPath, Size, Mtime, Ctime 
FROM glob(globs='C:/Users/*/Desktop/*', accessor='ntfs')
WHERE Mtime > now() - 86400  // Last 24 hours
   AND (FullPath =~ '.encrypted|.locked|.crypt' 
        OR FullPath =~ 'DECRYPT|README')

-- Check for shadow copy deletion artifacts
LET ShadowCopyCheck = SELECT * FROM wmi(
    namespace='root\\cimv2',
    query='SELECT * FROM Win32_ShadowCopy'
)

SELECT * FROM foreach(row=EncryptionHunt, query={
    SELECT FullPath, Size, Mtime, 
           ShadowCopyCheck.ID as ShadowID,
           ShadowCopyCheck.InstallDate as ShadowDate
    FROM scope()
})

# UNM Health Incident - Clinical Workstation Hardening Script
# Run on clinical workstations and EHR gateway servers to verify protections
# Requires administrative privileges

Write-Host "=== UNM Health Defense Verification Script ===" -ForegroundColor Cyan
Write-Host "Checking ransomware protections on: $env:COMPUTERNAME" -ForegroundColor Yellow

# 1. Verify Windows Defender Exploit Guard settings
Write-Host "`n[1] Checking Exploit Guard protections..." -ForegroundColor Green
$exploitProtection = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
if ($exploitProtection) {
    Write-Host "ASR Rules Configured: $($exploitProtection.Count)" -ForegroundColor Green
} else {
    Write-Host "WARNING: No ASR rules detected. Enable ransomware protection." -ForegroundColor Red
}

# 2. Check SMBv1 status (must be disabled)
Write-Host "`n[2] Checking SMBv1 status..." -ForegroundColor Green
$smbv1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
if ($smbv1.EnableSMB1Protocol -eq $false) {
    Write-Host "SMBv1 is DISABLED (Secure)" -ForegroundColor Green
} else {
    Write-Host "CRITICAL: SMBv1 is ENABLED. Disable immediately." -ForegroundColor Red
    Write-Host "Run: Set-SmbServerConfiguration -EnableSMB1Protocol `$false -Force" -ForegroundColor Yellow
}

# 3. Verify Shadow Copies exist and are protected
Write-Host "`n[3] Checking Volume Shadow Copies..." -ForegroundColor Green
$shadows = vssadmin list shadows 2>$null
if ($shadows) {
    $shadowCount = ($shadows | Select-String "Shadow Copy ID").Count
    Write-Host "Shadow copies available: $shadowCount" -ForegroundColor Green
} else {
    Write-Host "WARNING: No shadow copies detected. Verify backup system is operational." -ForegroundColor Yellow
}

# 4. Check for suspicious persistence mechanisms
Write-Host "`n[4] Scanning for suspicious persistence..." -ForegroundColor Green
$runKeys = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue
$suspicious = $runKeys.PSObject.Properties | Where-Object { 
    $_.Value -match "temp|appdata|public|programdata" -and 
    $_.Value -notmatch "OneDrive|Teams|Zoom" 
}
if ($suspicious) {
    Write-Host "Suspicious autoruns detected:" -ForegroundColor Red
    $suspicious | Format-Table Name, Value
} else {
    Write-Host "No obvious suspicious autoruns detected." -ForegroundColor Green
}

# 5. Verify network isolation settings for clinical VLANs
Write-Host "`n[5] Checking Windows Firewall status..." -ForegroundColor Green
$firewall = Get-NetFirewallProfile | Select-Object Name, Enabled
$firewall | Format-Table

# 6. Check RDP NLA requirement
Write-Host "`n[6] Checking RDP Network Level Authentication..." -ForegroundColor Green
$nla = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -ErrorAction SilentlyContinue
if ($nla.UserAuthentication -eq 1) {
    Write-Host "RDP NLA is ENABLED (Secure)" -ForegroundColor Green
} else {
    Write-Host "WARNING: RDP NLA is DISABLED. Enable to prevent brute force." -ForegroundColor Yellow
}

Write-Host "`n=== Verification Complete ===" -ForegroundColor Cyan
Write-Host "Review any RED flags immediately. Report suspicious findings to your SOC." -ForegroundColor Yellow