xHealth (zHealth) EHR Data Breach Exposes 118,000 Patients — Detection, Response, and Third-Party Risk Hardening Guide

---
title: Bulk Database Export or Dump Utility Execution
description: Detects execution of database dump/export utilities commonly used to stage bulk patient data for exfiltration from EHR/practice management backends. Tune Image list to your actual DB platform and alert on deviation from scheduled backup windows.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.collection
  - attack.t1530
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\sqlcmd.exe'
      - '\bcp.exe'
      - '\sqlbackupandftp.exe'
  selection_cli:
    CommandLine|contains:
      - '--all-databases'
      - 'SELECT * FROM'
      - 'OUT' 
      - 'queryout'
  condition: selection_img and (selection_cli or 1 of selection_img*)
falsepositives:
  - Scheduled backup jobs and DBA maintenance — whitelist known service accounts and maintenance windows
level: high
---
title: Mass Archive Creation via Command-Line Compression Tool
description: Detects interactive or scripted invocation of compression utilities (rar, 7z, tar) targeting directories likely to contain exported patient data — a hallmark staging step in healthcare data theft. High false-positive risk on build servers; scope to database/application hosts.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\tar.exe'
    CommandLine|contains:
      - ' a '
      - ' -r'
      - 'cvf'
  filter_backup_svc:
    User|contains:
      - 'svc_backup'
      - 'SYSTEM'
  condition: selection and not filter_backup_svc
falsepositives:
  - Legitimate archiving by administrators — whitelist approved service accounts and scheduled tasks
level: medium
---
title: Web Server Process Spawning Database or Shell Commands
id: 3c9f2b71-5a84-4d1e-9c07-8b6e5f4a2d31
description: Detects web application server processes (IIS, nginx, Apache, Node, Java/Tomcat) spawning shells or database clients — consistent with SQL injection or webshell activity against a multi-tenant patient portal.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\nginx.exe'
      - '\httpd.exe'
      - '\node.exe'
      - '\java.exe'
      - '\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sqlcmd.exe'
      - '\whoami.exe'
      - '\net.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy EHR apps shell out for reporting — validate per application owner
level: critical

// Hunt 1: Anomalous outbound data volume from servers (exfil detection)
// Requires Defender for Endpoint device network data; adjust window to your baseline
let baseline_window = 14d;
let detection_window = 1d;
let baseline = DeviceNetworkEvents
| where Timestamp between (ago(baseline_window) .. ago(detection_window))
| where RemoteIPType == "Public"
| summarize avg_daily_bytes = avg(tolong(BytesSent)) by DeviceName;
DeviceNetworkEvents
| where Timestamp > ago(detection_window)
| where RemoteIPType == "Public"
| summarize recent_bytes = sum(tolong(BytesSent)) by DeviceName
| join kind=inner baseline on DeviceName
| extend ratio = recent_bytes / (avg_daily_bytes * 1.0)
| where ratio > 5 and recent_bytes > 500000000  // >5x baseline and >500MB
| project DeviceName, recent_bytes, avg_daily_bytes, ratio
| order by ratio desc;

// Hunt 2: Database dump / archive utility execution on servers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("mysqldump.exe","pg_dump.exe","sqlcmd.exe","bcp.exe","rar.exe","7z.exe","7za.exe")
   or ProcessCommandLine has_any ("--all-databases","queryout"," a -r")
| where InitiatingProcessAccountName !in~ ("svc_backup","svc_sqlagent")  // tune to your env
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine, 20), count() by DeviceName, FileName, AccountName
| order by count_ desc;

// Hunt 3: Rare destination first-seen from PHI-hosting servers (via CEF/Syslog firewall ingestion)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Fortinet" or DeviceVendor =~ "Palo Alto Networks" or DeviceVendor =~ "Check Point"
| where DeviceAction in~ ("accept","allow","permit","close")
| summarize FirstSeen=min(TimeGenerated), Sessions=count() by SourceIP, DestinationIP, DestinationPort
| join kind=leftanti (
    CommonSecurityLog
    | where TimeGenerated between (ago(30d) .. ago(24h))
    | summarize by DestinationIP
) on DestinationIP
| where Sessions > 100
| order by Sessions desc;

-- Hunt for recently created large archives and database dump files on servers
SELECT FullPath, Size, Mtime, Btime,
       basename(path=FullPath) AS Filename
FROM glob(globs=['C:/Data/**/*.zip','C:/Data/**/*.rar','C:/Data/**/*.7z',
                 'C:/Backups/**/*.sql','C:/Users/**/*.zip','C:/Users/**/*.7z',
                 'C:/ProgramData/**/*.sql','C:/Temp/**/*.sql'],
          root='/')
WHERE Size > 50000000
  AND Mtime > (timestamp(epoch=now() - (7 * 24 * 3600)))
ORDER BY Mtime DESC

-- Hunt for live processes using compression or DB-dump tooling (active staging)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(rar|7z|7za|mysqldump|pg_dump|sqlcmd|bcp)'
   OR CommandLine =~ '(?i)(--all-databases|queryout| a -r)'

-- Enumerate established outbound connections from server processes to non-RFC1918 destinations
SELECT Pid, Name, Path, Raddr, Rport, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Raddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
  AND Path =~ '(?i)(sqlservr|mysqld|postgres|w3wp|node|java)'

# Security Arsenal - PHI Exfiltration Triage Audit (run elevated on EHR/DB/app servers)
# Output: CSV evidence bundle for IR review. Read-only - no system changes.
$out = "$env:TEMP\PHI_Triage_$(Get-Date -Format yyyyMMdd_HHmmss)"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. Process creation events for dump/compression tooling (requires 4688 auditing + cmdline)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'mysqldump|pg_dump|sqlcmd|bcp\.exe|rar\.exe|7z\.|--all-databases|queryout' } |
  Select-Object TimeCreated, Message |
  Export-Csv "$out\dump_tool_events.csv" -NoTypeInformation

# 2. Large archives/SQL exports created in the last 14 days
Get-ChildItem -Path 'C:\','D:\' -Recurse -Include *.zip,*.rar,*.7z,*.sql,*.bak,*.csv -ErrorAction SilentlyContinue |
  Where-Object { $_.Length -gt 50MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select-Object FullName, Length, LastWriteTime, CreationTime |
  Export-Csv "$out\large_recent_archives.csv" -NoTypeInformation

# 3. Established outbound connections from DB/web server processes to public IPs
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fe80)' } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.ProcessName -match 'sqlservr|mysqld|postgres|w3wp|node|java') {
      [PSCustomObject]@{ Process=$p.ProcessName; PID=$p.Id; Path=$p.Path
        RemoteIP=$_.RemoteAddress; RemotePort=$_.RemotePort }
    }
  } | Export-Csv "$out\server_outbound_connections.csv" -NoTypeInformation

# 4. Confirm command-line process auditing is enabled (GAP if missing - enable via GPO)
$cmdAudit = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
if ($cmdAudit -ne 1) {
  "WARNING: Process command-line auditing DISABLED. Enable 'Include command line in process creation events' via GPO." |
    Out-File "$out\AUDIT_GAPS.txt"
}
Write-Host "Triage bundle written to $out - review CSVs and escalate anomalies to IR." -ForegroundColor Cyan