Vishing Attack on Quantum Health: Defending Healthcare Networks Against Voice-Based Social Engineering and Help Desk Exploitation

---
title: MFA Method Change Followed by Password Reset on Same Account
id: 3f8a2c14-7b9d-4e51-a6f2-9c1d8e4b2a77
status: experimental
description: Detects an MFA device enrollment or modification occurring in close proximity to a password reset on the same account, a hallmark of help-desk social engineering and vishing-driven account takeover as seen in the Quantum Health intrusion.
references:
  - https://attack.mitre.org/techniques/T1656/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1656
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection_mfa:
    OperationName|contains:
      - 'Add strong authentication phone number'
      - 'User registered security info'
      - 'User changed default MFA method'
      - 'Add authentication method'
  selection_reset:
    OperationName|contains:
      - 'Reset user password'
      - 'Change user password'
  condition: selection_mfa or selection_reset
falsepositives:
  - Legitimate user-initiated self-service password reset with MFA re-enrollment
  - Onboarding of new employees
level: high
---
title: Privileged Help Desk Account Performing Bulk Password Resets
id: 8c1e5b92-3d47-4a68-bf15-2e7a9c4d1b83
status: experimental
description: Detects a single help desk or identity administrator account performing an abnormal volume of password resets or MFA resets within a short window, which may indicate the help desk operator is being actively manipulated by a vishing caller.
references:
  - https://attack.mitre.org/techniques/T1656/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1656
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4723  # password change attempt
      - 4724  # privileged password reset
  condition: selection
falsepositives:
  - Scheduled bulk password rotation activities
  - Password sync operations from identity management platforms
level: medium
---
title: Authentication from Anomalous Source Immediately After Credential Reset
id: 5d2a7f41-9e3c-4b82-a1d6-4f8c2e9b6a15
status: experimental
description: Detects VPN or remote access authentication from a source IP or geography with no prior history for the account within a short period following a password or MFA reset, consistent with a threat actor using freshly social-engineered credentials as in the Quantum Health breach.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID:
      - 4624
    LogonType:
      - 10  # RemoteInteractive
      - 3   # Network (VPN/RAS often logs type 3)
  filter_known:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_known
falsepositives:
  - Employees traveling or working from new locations
  - ISPs rotating customer IP ranges
level: medium

// Hunt: Correlate password/MFA resets with subsequent first-time sign-ins from new infrastructure.
// Deploy in Microsoft Sentinel against Entra ID (AAD) AuditLogs and SigninLogs.
// Tune the lookback window and new-IP baseline to your environment's size.

let ResetEvents = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has_any ("Reset user password", "Change user password",
    "User registered security info", "Add strong authentication phone number",
    "User changed default MFA method")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend ResetTime = TimeGenerated
| extend InitiatedByActor = tostring(InitiatedBy.user.userPrincipalName)
| project TargetUser, ResetTime, OperationName, InitiatedByActor, CorrelationId;
ResetEvents
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(24h)
    | where ResultType == 0
    | extend SigninIP = IPAddress, SigninTime = TimeGenerated
    | project UserPrincipalName, SigninTime, SigninIP, Location, AppDisplayName,
        DeviceDetail, UserAgent
) on $left.TargetUser == $right.UserPrincipalName
| where SigninTime between (ResetTime .. ResetTime + 4h)
// Exclude IPs the user has authenticated from in the prior 30 days
| where SigninIP !in (
    SigninLogs
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where ResultType == 0
    | summarize by IPAddress
    | summarize make_list(IPAddress)
)
| project TargetUser, ResetTime, OperationName, InitiatedByActor,
    SigninTime, SigninIP, Location, AppDisplayName, UserAgent
| sort by ResetTime desc

-- Hunt for evidence of post-compromise staging on endpoints accessed after
-- suspected vishing-driven account takeover: newly created local admin use,
-- suspicious RMM tooling, and credential-access artifacts.
-- Deploy as a Velociraptor notebook or fleet hunt artifact.

LET suspicious_rmm = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(anydesk|screenconnect|connectwise|teamviewer|splashtop|atera|ninjaone|level\.io|rustdesk)'
   OR Exe =~ '(?i)(anydesk|screenconnect|teamviewer|rustdesk)'

LET suspicious_procs = SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(whoami|nltest|net group|quser|ipconfig /all)'
  AND Username =~ '(?i).+'

LET net_conns = SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND RemotePort in (443, 8443, 3389)
  AND NOT RemoteAddr =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'

SELECT * FROM suspicious_rmm
UNION ALL
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime FROM suspicious_procs

# Quantum Health vishing lesson - help desk identity integrity audit and hardening.
# Run on a domain-joined management station with the ActiveDirectory and
# Microsoft.Graph modules available. Review output before enforcing changes.

# 1. Audit password resets performed in the last 72 hours - who reset, for whom, when
$start = (Get-Date).AddHours(-72)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724; StartTime=$start} -ErrorAction SilentlyContinue |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            Time        = $_.TimeCreated
            ResetBy     = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
            TargetUser  = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
            SourceHost  = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
        }
    } | Group-Object ResetBy |
    Where-Object { $_.Count -gt 5 } |
    ForEach-Object { Write-Warning "$($_.Name) performed $($_.Count) privileged resets in 72h - verify against help desk ticket records" }

# 2. Identify accounts with MFA registered in the last 7 days (review for attacker-enrolled methods)
Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All" -NoWelcome
$cutoff = (Get-Date).AddDays(-7)
Get-MgUser -All -Property Id,UserPrincipalName | ForEach-Object {
    $methods = Get-MgUserAuthenticationMethod -UserId $_.Id -ErrorAction SilentlyContinue
    foreach ($m in $methods) {
        $odata = $m.AdditionalProperties
        if ($odata.createdDateTime -and ([datetime]$odata.createdDateTime) -gt $cutoff) {
            [PSCustomObject]@{
                User          = $_.UserPrincipalName
                MethodType    = $m.AdditionalProperties['@odata.type']
                RegisteredOn  = $odata.createdDateTime
            }
        }
    }
} | Export-Csv -Path ".\RecentMFARegistrations.csv" -NoTypeInformation
Write-Host "Review RecentMFARegistrations.csv against help desk tickets - every entry must map to a verified ticket." -ForegroundColor Yellow

# 3. Enforce strong verification for remote MFA registration: require Temporary Access Pass
#    or verified ID for help-desk-initiated resets. Confirm TAP policy is enabled.
Get-MgPolicyAuthenticationMethodPolicy | Format-List Id, DisplayName, State

# 4. Restrict self-service + help-desk password reset for privileged groups.
#    Create a group of protected accounts and verify SSPR scoping excludes them.
Get-MgGroup -Filter "startswith(displayName,'SG-Identity-Protected')" -ErrorAction SilentlyContinue |
    Format-Table DisplayName, Id
Write-Host "ACTION: In Entra portal, scope SSPR to a group that EXCLUDES privileged and executive accounts." -ForegroundColor Cyan
Write-Host "ACTION: Require in-person or video-verified identity proofing for resets on protected accounts." -ForegroundColor Cyan