Web Tracking Pixel Data Exfiltration: Detection and Incident Response Playbook

---
title: Potential PHI Exfiltration via Meta Pixel
id: 8a2b1c9d-0e3f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects outbound connections to known Meta/Facebook tracking domains from internal networks or web servers, which may indicate pixel data leakage.
references:
  - https://www.hipaajournal.com/atrium-health-pixel-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: proxy
  product: any
detection:
  selection:
    cs-host|contains:
      - 'connect.facebook.net'
      - 'www.facebook.com/tr'
      - 'www.facebook.com/tr/'
  filter_generic:
    cs-uri-query|contains:
      - 'fbclid'
  condition: selection and not filter_generic
falsepositives:
  - Legitimate marketing department activity (verify source IP)
level: medium
---
title: Healthcare Web Server Connection to Analytics Domains
id: 9b3c2d0e-1f4a-5b6c-9d8e-0f1a2b3c4d5e
status: experimental
description: Identifies web server infrastructure connecting to Google Analytics or similar tracking domains. This is high-risk if the server serves PHI.
references:
  - https://www.hipaajournal.com/atrium-health-pixel-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'google-analytics.com'
      - 'doubleclick.net'
      - 'connect.facebook.net'
  filter:
    Image|contains:
      - 'chrome.exe'
      - 'firefox.exe'
      - 'edge.exe'
  condition: selection and not filter_positive
falsepositives:
  - Administrator troubleshooting
level: high

// Hunt for tracking pixel traffic from Web Servers
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("connect.facebook.net", "www.facebook.com", "google-analytics.com", "www.google-analytics.com", "bat.bing.com")
| where ActionType == "ConnectionSuccess"
| where DeviceName has_any ("web", "portal", "iap") // Customize to naming convention
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, LocalPort, RemotePort
| extend PixelDomain = RemoteUrl
| summarize count() by PixelDomain, DeviceName, bin(Timestamp, 1h)
| order by count_ desc

-- Hunt for active connections to tracking domains
SELECT Fqdn, RemoteAddress, Pid, Process.Name, Username
FROM listen()
WHERE Fqdn =~ 'facebook' OR Fqdn =~ 'google-analytics' OR Fqdn =~ 'doubleclick'

-- Alternative: Scan browser history for tracking pixel hits
SELECT Client, Url, LastVisitTime
FROM chrome_history(url LIKE '%facebook%tr%') OR chrome_history(url LIKE '%google-analytics%collect%')

<#
.SYNOPSIS
    Audits IIS Logs for potential Pixel Exfiltration to Meta/Facebook.
.DESCRIPTION
    Scans IIS log files for requests to known tracking domains (facebook.com/tr)
    to identify potential PHI leakage points.
#>

$LogPath = "C:\inetpub\logs\LogFiles\"
$TrackingDomains = @("facebook.com/tr", "connect.facebook.net", "www.facebook.com/tr")
$Results = @()

if (Test-Path $LogPath) {
    Write-Host "Scanning IIS logs in $LogPath..."
    
    # Get recent log files (last 30 days)
    $LogFiles = Get-ChildItem -Path $LogPath -Recurse -Filter "u_ex*.log" | 
                 Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }

    foreach ($File in $LogFiles) {
        # Search for tracking domain hits in CS-URI-STEM or CS-REFERRER
        $Hits = Select-String -Path $File.FullName -Pattern $TrackingDomains -SimpleMatch
        
        if ($Hits) {
            foreach ($Hit in $Hits) {
                $Results += [PSCustomObject]@{
                    LogFile    = $File.Name
                    Line       = $Hit.LineNumber
                    LogEntry   = $Hit.Line.ToString().Trim()
                    Timestamp  = $Hit.Line.Split(' ')[0] + " " + $Hit.Line.Split(' ')[1]
                }
            }
        }
    }

    if ($Results.Count -gt 0) {
        Write-Warning "Potential Pixel Exfiltration Detected!"
        $Results | Format-Table -AutoSize
        
        # Export to CSV for compliance review
        $ExportPath = "$env:USERPROFILE\Desktop\PixelAudit_$(Get-Date -Format 'yyyyMMdd').csv"
        $Results | Export-Csv -Path $ExportPath -NoTypeInformation
        Write-Host "Results exported to $ExportPath"
    } else {
        Write-Host "No potential pixel activity found in the last 30 days of logs."
    }
} else {
    Write-Error "IIS Log path not found: $LogPath"
}