Veradigm Patient Data Breach: Defending Healthcare Orgs Against Third-Party Vendor Compromise and The Gentlemen Ransomware

---
title: Shadow Copy Deletion via Native Windows Utilities
description: Detects deletion of volume shadow copies using vssadmin, wmic, or PowerShell — a near-universal precursor to ransomware encryption observed in The Gentlemen and peer operations.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.bleepingcomputer.com/news/security/veradigm-discloses-patient-data-breach-after-gentlemen-gang-claims-attack/
author: Security Arsenal
id: 3f8c2a71-9b4d-4e62-a1c8-7d5e9f0b2a34
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Remove-WmiObject win32_shadowcopy'
      - 'Get-WmiObject Win32_Shadowcopy'
  condition: selection_img and selection_cli
falsepositives:
  - Rare. Backup administrators occasionally resize shadowstorage; deletion of all shadows is not legitimate routine activity.
level: high
---
title: Backup Catalog and Boot Configuration Tampering
description: Detects wbadmin catalog deletion and bcdedit recovery-disabling commands, used by ransomware operators to prevent system recovery before encryption.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
id: 8a1d4e96-2c7f-4b38-9d51-3e6a0f4c8b17
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Some imaging/provisioning tools modify boot configuration. Correlate with other ransomware precursors before dismissing.
level: high
---
title: Mass File Renaming Indicative of Ransomware Encryption
description: Detects high-volume file rename operations by a single process within a short window — a behavioral indicator of active file encryption.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
id: 5c9e7b02-4a1d-4f83-b6e2-0d8c3a7f5e91
status: experimental
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.crypted'
  condition: selection
falsepositives:
  - Legitimate encryption tools are uncommon on servers. Tune the extension list to confirmed gang extensions during an active incident; treat any hit as P1 pending triage.
level: critical

// Hunt 1: Ransomware recovery-destruction tooling (vssadmin/wbadmin/bcdedit)
let recoveryTools = dynamic(["vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "wmic.exe"]);
let destructiveArgs = dynamic(["delete shadows", "delete catalog", "recoveryenabled no", "ignoreallfailures", "shadowcopy delete"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has_any (recoveryTools)
    | where ProcessCommandLine has_any (destructiveArgs)
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName),
    (SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4688
    | where Process has_any (recoveryTools)
    | where CommandLine has_any (destructiveArgs)
    | project TimeGenerated, DeviceName = Computer, AccountName = Account, FileName = Process, ProcessCommandLine = CommandLine, InitiatingProcessFileName = ParentProcessName);

// Hunt 2: Anomalous activity from third-party vendor accounts
// Replace vendor domain/UPN suffixes with your actual vendor account naming conventions
let vendorAccounts = dynamic(["@vendor", "-svc-", "_ext", "@partner"]);
SigninLogs
| where TimeGenerated > ago(14d)
| where UserPrincipalName has_any (vendorAccounts)
| where ResultType != 0 or IPAddress !in (dynamic([]))  // failed logons OR unexpected IPs
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            Locations=make_set(Location), IPs=make_set(IPAddress),
            Apps=make_set(AppDisplayName), Attempts=count()
    by UserPrincipalName
| where array_length(IPs) > 3 or Attempts > 50
| order by Attempts desc;

// Hunt 3: Bulk file access on PHI repositories (data staging for exfiltration)
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("\\ehr\\", "\\phi\\", "\\patient", "\\backup\\", "\\shares\\")
| summarize FileOps=count(), DistinctPaths=dcount(FolderPath)
    by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 15m)
| where FileOps > 500
| order by FileOps desc;

-- Hunt for ransomware precursor activity: recovery-tool execution,
-- suspicious processes running from temp/appdata, and shadow copy state
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|delete catalog|recoveryenabled no|shadowcopy)'
   OR Exe =~ '(?i)(\\temp\\|\\appdata\\|\\programdata\\|\\users\\public\\)[^\\]+\.exe$'

// Cross-reference: verify shadow copies still exist on the host
SELECT * FROM execve(argv=['powershell.exe', '-Command',
   'Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, InstallDate'])

# ============================================================
# Ransomware Recovery Posture & Tampering Audit - Security Arsenal
# Run elevated on PHI-adjacent servers and vendor jump boxes
# ============================================================

# 1. Verify shadow copies exist and report last creation time
Write-Host "[*] Checking Volume Shadow Copy state..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
} else {
    Write-Host "[!] WARNING: No shadow copies found. Verify backup coverage." -ForegroundColor Red
}

# 2. Confirm System Protection is enabled on all fixed volumes
Write-Host "[*] Checking System Protection status per volume..." -ForegroundColor Cyan
Get-CimInstance Win32_Volume | Where-Object { $_.DriveLetter } | ForEach-Object {
    $vol = $_.DriveLetter
    try {
        $status = (Get-ComputerRestorePoint -ErrorAction Stop | Out-Null; "Queryable")
    } catch { $status = "Unknown/Disabled" }
    Write-Host "    $vol - Restore point status: $status"
}
vssadmin list shadowstorage

# 3. Audit recent use of recovery-destruction commands (last 7 days)
Write-Host "[*] Auditing process creation events for destructive tooling..." -ForegroundColor Cyan
$start = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$start} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'delete shadows|delete catalog|recoveryenabled no|shadowcopy delete|ignoreallfailures' } |
    Select-Object TimeCreated, Message | Format-List

# 4. Audit local admins and recently added accounts (vendor persistence check)
Write-Host "[*] Enumerating local administrators for unexpected vendor accounts..." -ForegroundColor Cyan
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize

Write-Host "[*] Accounts created in the last 30 days..." -ForegroundColor Cyan
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-30) } |
    Select-Object Name, Enabled, LastLogon, PasswordLastSet | Format-Table -AutoSize

# 5. Verify SMBv1 disabled (legacy lateral-movement surface)
Write-Host "[*] SMBv1 status:" -ForegroundColor Cyan
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue |
    Select-Object FeatureName, State