Verizon 2026 DBIR: Defending Against Rising Social Engineering Attacks in Healthcare

---
title: Potential BEC Fraud Indicators in Email Headers
id: 77b8a2d4-e8f1-4a3c-9b2e-5f6c7a8d9e0f
status: experimental
description: Detects potential Business Email Compromise indicators including reply-to mismatches, newly registered domains, and suspicious keywords in healthcare context.
references:
  - https://www.darkreading.com/cyber-risk/verizon-dbir-healthcare-fends-off-increased-social-engineering-attacks
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  product: email
detection:
  selection_keywords:
    Subject|contains:
      - 'urgent patient matter'
      - 'invoice past due'
      - 'wire transfer confirmation'
      - 'change banking details'
      - 'verify insurance claim'
  selection_replyto:
    Reply-ToAddress|contains:
      - '@gmail.com'
      - '@yahoo.com'
      - '@outlook.com'
  selection_domain:
    SenderFromAddress|endswith:
      - '.com'
      - '.org'
      - '.net'
  condition: 1 of selection_*
falsepositives:
  - Legitimate patient communications
  - Vendor correspondence
level: medium
---
title: Unusual PHI Access Patterns
id: 88c9b3e5-f9g2-5b4d-0c3f-6g7d8e9f0a1g
status: experimental
description: Detects potential data exfiltration patterns indicative of social engineering compromise in healthcare environments, focusing on unusual EHR access volumes.
references:
  - https://www.darkreading.com/cyber-risk/verizon-dbir-healthcare-fends-off-increased-social-engineering-attacks
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5140
    ShareName|contains:
      - 'PHI'
      - 'EHR'
      - 'PatientRecords'
    SubjectUserName|contains:
      - 'admin'
      - 'service'
  filter:
    IpAddress:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative access
  - Authorized backup operations
level: high
---
title: Suspicious MFA Bypass Attempts
id: 99d0c4f6-0a3-6c5e-1d4g-7h8e9f0a1b2c
status: experimental
description: Detects potential MFA bypass techniques often used after successful social engineering credential harvesting.
references:
  - https://www.darkreading.com/cyber-risk/verizon-dbir-healthcare-fends-off-increased-social-engineering-attacks
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.defense_evasion
  - attack.t1556
logsource:
  category: authentication
  product: azuread
detection:
  selection:
    ResultDescription|contains:
      - 'MFA bypass'
      - 'Legacy authentication'
      - 'Basic auth'
    AppDisplayName|contains:
      - 'Exchange ActiveSync'
      - 'Autodiscover'
      - 'Outlook'
  condition: selection
falsepositives:
  - Legacy application configurations
  - Authorized service accounts
level: high

// Hunt for potential social engineering compromise indicators
// Focus on unusual access patterns in healthcare environments
let Timeframe = 1d;
let HighRiskCountries = dynamic(['CN', 'RU', 'KP', 'IR']);
let EHRApplications = dynamic(['Epic', 'Cerner', 'Allscripts', 'MEDITECH']);

// Unusual login locations for healthcare users
IdentityLogonEvents
| where Timestamp > ago(Timeframe)
| where Application in EHRApplications
| where isnotempty(Location)
| where CountryRegion in~ HighRiskCountries
| project Timestamp, AccountUpn, Application, DeviceName, Location, CountryRegion, RiskLevel
| distinct Timestamp, AccountUpn, Application, Location, RiskLevel
;

// Large volume record access indicative of potential data exfiltration
DeviceFileEvents
| where Timestamp > ago(Timeframe)
| where FileName contains @'PHI' or FileName contains @'patient' or FileName contains @'medical'
| where ActionType == 'FileAccessed'
| summarize Count=count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where Count > 100  // Threshold depends on environment
| project DeviceName, InitiatingProcessAccountName, Count, Timestamp
| order by Count desc
;

// Suspicious PowerShell activity often seen in post-exploitation
DeviceProcessEvents
| where Timestamp > ago(Timeframe)
| where FileName =~ 'powershell.exe'
| where ProcessCommandLine contains @'Invoke-WebRequest' or ProcessCommandLine contains @'DownloadString' or ProcessCommandLine contains @'IEX'
| summarize Count=count() by DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| where Count > 5
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc
;

-- Hunt for potential social engineering compromise indicators in healthcare
-- Check for suspicious process execution patterns
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'powershell.exe'
   AND (CommandLine =~ 'Invoke-WebRequest' 
        OR CommandLine =~ 'DownloadString'
        OR CommandLine =~ 'IEX'
        OR CommandLine =~ 'EncodedCommand'
        OR CommandLine =~ 'FromBase64String')
;

-- Check for unusual network connections to suspicious endpoints
SELECT Fd, Family, RemoteAddress, RemotePort, Pid, StartTime, EndTime
FROM netstat()
WHERE RemotePort IN (443, 445, 3389)
   AND NOT RemoteAddress =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)'
;

-- Hunt for recently created files in sensitive directories
SELECT Path, Size, Mode, Mtime, Atime, Btime
FROM glob(globs='/*')
WHERE Mtime > now() - 24h
   AND (Path =~ 'PHI' 
        OR Path =~ 'patient' 
        OR Path =~ 'medical' 
        OR Path =~ 'health')
;

# Healthcare Security Hardening Script for Social Engineering Defense
# This script implements key controls to mitigate social engineering risks

# Function to check for and disable legacy authentication protocols
function Disable-LegacyAuthProtocols {
    Write-Host "Checking for legacy authentication protocols..."
    
    # Check Basic Authentication in Exchange Online
    $authPolicies = Get-AuthenticationPolicy | Where-Object { $_.AllowBasicAuthActiveSync -eq $true -or $_.AllowBasicAuthAutodiscover -eq $true }
    
    if ($authPolicies) {
        Write-Host "WARNING: Legacy authentication policies detected:" -ForegroundColor Yellow
        $authPolicies | ForEach-Object { Write-Host " - $($_.Name)" }
        Write-Host "Action required: Disable legacy authentication via Set-AuthenticationPolicy" -ForegroundColor Red
    } else {
        Write-Host "No legacy authentication policies found." -ForegroundColor Green
    }
}

# Function to verify MFA enforcement for critical healthcare applications
function Verify-MFAEnforcement {
    Write-Host "Verifying MFA enforcement for critical applications..."
    
    # This would typically connect to Azure AD and check conditional access policies
    # Here we simulate the check
    Write-Host "Checking MFA policies for EHR, VPN, and Email access..."
    Write-Host "Ensure the following Conditional Access policies are configured:"
    Write-Host "1. Require MFA for all users accessing EHR applications"
    Write-Host "2. Require MFA for all administrative accounts"
    Write-Host "3. Block legacy authentication for Exchange Online"
    Write-Host "4. Require compliant devices for PHI access"
    Write-Host "5. Implement location-based restrictions for remote access"
}

# Function to check email security configuration
function Check-EmailSecurity {
    Write-Host "Checking email security configuration..."
    
    # Check SPF records (simplified check)
    Write-Host "Verifying SPF records for your domain..."
    Write-Host "Ensure SPF records are set to '-all' (hard fail) rather than '~all' (soft fail)"
    
    # Check DMARC records (simplified check)
    Write-Host "Verifying DMARC records for your domain..."
    Write-Host "Ensure DMARC policy is set to 'p=reject' rather than 'p=none' or 'p=quarantine'"
    
    # Check DKIM signing
    Write-Host "Verifying DKIM signing configuration..."
    Write-Host "Ensure DKIM is enabled for all email-sending domains"
}

# Main execution
Write-Host "Healthcare Social Engineering Security Hardening" -ForegroundColor Cyan
Write-Host "============================================" -ForegroundColor Cyan
Write-Host ""

Disable-LegacyAuthProtocols
Write-Host ""
Verify-MFAEnforcement
Write-Host ""
Check-EmailSecurity
Write-Host ""

Write-Host "Security hardening check complete." -ForegroundColor Green
Write-Host "Review the warnings above and implement recommended actions." -ForegroundColor Yellow