WPM Pathology Laboratory and Salina Regional Health Center Breach Settlement: Defensive Lessons from a Targeted Healthcare Cyberattack

---
title: Data Staging and Archive Creation by Compression Tools
id: 8f2c4d71-3a9b-4e56-b7c8-2d4f6a8e1c3b
status: experimental
description: Detects command-line archive creation consistent with bulk data staging prior to exfiltration, a hallmark of targeted healthcare intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1074/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -v'
      - ' -r'
  filter_users:
    CommandLine|contains:
      - 'C:\Program Files'
      - 'C:\Program Files (x86)'
  condition: selection_img and selection_cli and not filter_users
falsepositives:
  - Legitimate backup and packaging workflows; allowlist approved archiving scripts and service accounts
level: medium
---
title: Volume Shadow Copy Deletion Attempt
id: 3b7e9a12-5c4d-4f8a-9e6b-1a3c5d7f9b2e
status: experimental
description: Detects deletion of volume shadow copies via vssadmin, wmic, or PowerShell — a near-universal precursor to ransomware impact in healthcare intrusions.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Win32_ShadowCopy'
  condition: selection_vss
falsepositives:
  - Rare; legitimate storage management almost never deletes shadows interactively. Investigate every hit.
level: critical
---
title: Exfiltration Tool Execution (Rclone and Cloud Sync Utilities)
id: 6d1f8c34-7b2e-4a5c-8d9f-4e6a2c8b1d5f
status: experimental
description: Detects execution of Rclone or consumer cloud-sync binaries frequently abused for bulk PHI exfiltration to attacker-controlled storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\megacmd.exe'
      - '\filen.exe'
  condition: selection_img
falsepositives:
  - Organizations with sanctioned Rclone backup jobs; allowlist by hash and service account
level: high

// Hunt: PHI staging and exfiltration behavior across clinical and lab systems
// Surfaces compression + cloud exfil + shadow deletion on servers hosting ePHI
let SensitiveHosts = dynamic(["LIS", "LAB", "PACS", "EHR", "FILE"]);
union withsource=tableName_
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","rclone.exe","vssadmin.exe","wmic.exe")
   or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","copy ","sync "," -p"," --transfers")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName, tableName_),
(SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where CommandLine has_any ("delete shadows","rclone","7z a","rar a","megasync")
| project TimeGenerated, DeviceName=Computer, FileName=NewProcessName, ProcessCommandLine=CommandLine, AccountName, InitiatingProcessFileName=ParentProcessName, tableName_)
| where DeviceName has_any (SensitiveHosts) or true  // remove "or true" once host naming is tuned
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Commands=make_set(ProcessCommandLine, 10)
  by DeviceName, FileName, AccountName
| order by LastSeen desc

-- Hunt: staging directories and compression artifacts on file servers and clinical hosts
-- Looks for recently created archives in non-standard paths plus suspicious tooling
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/Desktop/*.7z',
  'C:/Users/*/Desktop/*.zip',
  'C:/Users/*/Desktop/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar',
  'C:/Windows/Temp/*.7z',
  'C:/Windows/Temp/*.rar',
  'D:/**/*.7z',
  'D:/**/*.rar'
])
WHERE Mtime > now() - 604800
  AND Size > 10485760
ORDER BY Mtime DESC

-- Correlate with live execution of exfiltration-capable tooling
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(rclone|megasync|7z|winrar|filezilla|winscp)'
   OR Exe =~ '(?i)(AppData|ProgramData|Temp).*(rclone|7z|rar)'

# Verify-HealthCareBreachPosture.ps1
# Validates backup integrity, shadow copy protection, and MFA coverage after a targeted-intrusion tabletop
# Run elevated on domain controllers and file servers hosting ePHI

Write-Host "=== [1] Volume Shadow Copy Status ===" -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object VolumeName, InstallDate, @{N='SizeGB';E={[math]::Round($_.UsedSpace/1GB,2)}}
$shadowStorage = vssadmin list shadowstorage 2>$null
if (-not $shadowStorage) { Write-Warning "No shadow storage configured — ransomware recovery posture is degraded." }

Write-Host "=== [2] Recent Archive Creation in Staging-Prone Paths (last 7 days) ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
foreach ($path in @('C:\ProgramData','C:\Windows\Temp','C:\Users')) {
  if (Test-Path $path) {
    Get-ChildItem $path -Recurse -Include *.7z,*.rar,*.zip -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 10MB } |
      Select-Object FullName, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,1)}}
  }
}

Write-Host "=== [3] Exfiltration Tool Presence ===" -ForegroundColor Cyan
Get-ChildItem 'C:\','D:\' -Recurse -Include rclone.exe,megasync.exe,filen.exe -ErrorAction SilentlyContinue -Depth 4 |
  Select-Object FullName, LastWriteTime

Write-Host "=== [4] RDP Exposure Audit ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
Write-Host "RDP Disabled flag: $($rdp.fDenyTSConnections) (1 = disabled, 0 = enabled — restrict 3389 to VPN/jump hosts only)"
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host "NLA Enabled: $($nla.UserAuthentication) (must be 1)"

Write-Host "=== [5] SMBv1 Check (lateral movement vector on legacy clinical systems) ===" -ForegroundColor Cyan
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
Write-Host "SMBv1 State: $($smb1.State) — disable unless a documented legacy device requires it, then isolate that device."

Write-Host "=== [6] Admin Share & Flat-Network Sanity Check ===" -ForegroundColor Cyan
Get-SmbShare | Where-Object { $_.Name -in @('C$','ADMIN$','D$') } | Select-Object Name, Path
Write-Host "Confirm firewall rules block workstation-to-workstation SMB (445) — lateral movement depends on it."