Healthcare (OT) - Module User Guide

This guide is meant to be used as a day-to-day reference for the Healthcare (OT) module's content. All the content included in this module is listed below, along with a detailed explanation, suggested response, and configuration and tuning notes.

Suppression Period: The Suppression Multiple in conjunction with the Suppression Period defines how much time must pass before the same AI Engine rule can be triggered again for the same set of criteria. Measured in minutes in this guide.

Environmental Dependence Factor: EDF is a high-level quantification of how much effort is required in configuration and tuning for an AI Engine rule to perform as expected. This setting has no impact on processing.

False Positive Probability: The False Positive Probability is used in Risk-Based Priority (RBP) calculation for AI Engine Rules. It estimates how likely the rule is to generate a false positive response. A value of "low" indicates the pattern the rule matches is almost always a true positive. However, a value of "high" indicates the pattern the rule matches is very likely to be a false positive.

Options range from 0 to 9 with:

0 indicating the pattern the rule matched is almost always a true positive.
9 indicating the pattern the rule matched is very likely to be a false positive.

AIE Rules

AIE Rule Name	HC: Account Added To Privileged Group
AIE Rule ID	1567
AIE Rule Brief Description	Observes for an account added to an admin/privileged user group
Classification	Security : Suspicious
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	Low
False Positive Probability	Low-Medium
AIE Rule Additional Details	Use case: An adversary has compromised a domain controller of a hospital network and created a new admin/privileged user group account Configuration: Population of the Privileged Groups list is required and, to maintain accuracy, a quarterly review of this list is recommended

AIE Rule Name	HC: Admin Password Modified
AIE Rule ID	1568
AIE Rule Brief Description	Observes for an admin/privileged user password modification
Classification	Security : Suspicious
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	Medium
False Positive Probability	Low-High
AIE Rule Additional Details	Use case: An adversary has gained access to an admin account on a hospital network and changes the credentials of another admin account to gain access to other systems, applications, databases, and/or data Configuration: Population of the HC: Privileged Users list is required and, to maintain accuracy, a quarterly review of this list is recommended Optional configuration: To exclude system accounts from this alarm, add an exclude filter for an Origin Login or Account which matches this regular expression: \$$

AIE Rule Name	HC: Crit Application Config Change
AIE Rule ID	1569
AIE Rule Brief Description	Observes for changes to critical application configurations
Classification	Audit : Configuration
Event Suppression Period	1
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: Monitor for planned/unplanned configuration changes to critical healthcare applications to prevent potential application downtime Configuration: Include Filters should be added to the rule block for critical hosts and/or applications/processes that are in scope for the analytic

AIE Rule Name	HC: Crit Backup Failure
AIE Rule ID	1570
AIE Rule Brief Description	Observes for failed critical backup events
Classification	Operations : Critical
Event Suppression Period	1
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: Monitor for failed backup events to critical healthcare applications/systems to prevent potential data loss and downtime Configuration: Include Filters should be added to the rule block for critical backup hosts that are in scope for the analytic

AIE Rule Name	HC: Crit Database Config Change
AIE Rule ID	1571
AIE Rule Brief Description	Observes for changes to critical database configurations
Classification	Audit : Configuration
Event Suppression Period	1
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: Monitor for changes to critical database systems to prevent potential disruption to clinical, laboratory, and research data Configuration: Include Filters should be added to the rule block for critical hosts and/or database objects that are in scope for the analytic

AIE Rule Name	HC: Crit Net Access Config Change
AIE Rule ID	1572
AIE Rule Brief Description	Observes for changes to critical network access configurations
Classification	Audit : Configuration
Event Suppression Period	1
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: Monitor for changes to network access configurations to prevent potential disruption of network connectivity for critical applications and systems, such as patient remote monitoring Configuration: Include Filters should be added to the rule block for critical hosts and/or network segments that are in scope for the analytic

AIE Rule Name	HC: Crit Service Stopped
AIE Rule ID	1573
AIE Rule Brief Description	Observes for critical service stop events that are not followed by service start events
Classification	Operations : Critical
Event Suppression Period	5
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An employee has opened a document containing malware that has killed all active services on a medication administration system Configuration: Include Filters should be added to the rule block for critical log sources and services that are in scope for the analytic

AIE Rule Name	HC: Crit System Config Change
AIE Rule ID	1574
AIE Rule Brief Description	Observes for changes to critical system configurations
Classification	Audit : Configuration
Event Suppression Period	1
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: A healthcare systems administrator implements a system configuration change that results in critical system downtime Configuration: Include Filters should be added to the rule block for critical hosts that are in scope for the analytic

AIE Rule Name	HC: Crit System Shutdown
AIE Rule ID	1575
AIE Rule Brief Description	Observes for critical system shutdowns that are not followed by startup activity
Classification	Audit : Startup and Shutdown
Event Suppression Period	30
Alarm on Event Occurrence	Yes
Environmental Dependency Factor	Medium
False Positive Probability	High-Low
AIE Rule Additional Details	Use case: A critical medical device (e.g., infusion pump) connected to a hospital network shuts down and fails to restart automatically Configuration: Must be tuned to select "always on" hosts, along with identifying the appropriate timeframe for the system startup after shutdown activity; to reduce alarms from this rule, specific systems or an entity containing critical systems should be defined within the Primary Criteria for each block and Log Source Criteria for each block should be defined to limit alarms to specific critical systems

AIE Rule Name	HC: Data Copy To Removable Device
AIE Rule ID	1576
AIE Rule Brief Description	Observes for data transfer to a removable device (e.g., USB drive)
Classification	Audit : Access Success
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A malicious employee accesses a patient records database and downloads PHI details to a USB drive with the intent of selling the details on the Dark Web Configuration: Data Loss Defender (DLD) feature should be enabled for the endpoints in scope with this analytic (see https://docs.logrhythm.com/lrsiem/7.14.0/data-loss-defender-dld)

AIE Rule Name	HC: Default Or Weak Password
AIE Rule ID	1577
AIE Rule Brief Description	Observes for a default or weak password
Classification	Security : Vulnerability
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary uses the hard-coded or default password of a medical device to force unscheduled downtime of the device

AIE Rule Name	HC: Device Modified
AIE Rule ID	1578
AIE Rule Brief Description	Observes for device modifications
Classification	Audit : Access Success
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A hospital systems administrator creates a new medical device network profile or moves a medical device to a new network group

AIE Rule Name	HC: Device Sent Plaintext Credentials
AIE Rule ID	1579
AIE Rule Brief Description	Observes for device transmission of a plaintext password
Classification	Security : Vulnerability
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary conducting a man-in-the-middle attack on a hospital network obtains the password for a medical device

AIE Rule Name	HC: Device Software Vulnerability
AIE Rule ID	1580
AIE Rule Brief Description	Observes for device software vulnerabilities
Classification	Security : Vulnerability
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator has a requirement to identify medical devices affected by industry-specific recalls or security alerts

AIE Rule Name	HC: Door Access Granted
AIE Rule ID	1581
AIE Rule Brief Description	Observes for successful door authentications
Classification	Audit : Access Success
Event Suppression Period	30
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: An individual successfully accesses a restricted room, office, elevator, etc. of a hospital via badge or biometric device

AIE Rule Name	HC: Expired Certificate
AIE Rule ID	1582
AIE Rule Brief Description	Observes for an expired TLS certificate
Classification	Operations : Warning
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A certificate for a critical cloud-based service that provides ongoing instructions to a ventilator system expires while fetching patient data to determine next course of action treatment

AIE Rule Name	HC: File Deletion Activity
AIE Rule ID	1583
AIE Rule Brief Description	Observes for file deletions
Classification	Security : Suspicious
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary with compromised credentials accesses and deletes files within a biomedical research database Configuration: File Integrity Monitoring enablement required

AIE Rule Name	HC: Firmware Change
AIE Rule ID	1584
AIE Rule Brief Description	Observes for device firmware changes
Classification	Operations : Information
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary with knowledge of a patient monitor hard-coded credentials vulnerability installs unauthorized firmware for malicious purposes

AIE Rule Name	HC: Malicious IP
AIE Rule ID	1585
AIE Rule Brief Description	Observes for device communication with a destination IP flagged as potentially malicious
Classification	Security : Other Security
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator requires insight into medical devices that are communicating with potentially malicious IP addresses

AIE Rule Name	HC: Multiple Account Lockouts
AIE Rule ID	1586
AIE Rule Brief Description	Observes for an account locked out multiple times (>=3) per hour
Classification	Audit : Access Revoked
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	Low
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary conducts a brute force password attack attempting to access a system containing confidential patient clinical notes Configuration: The volume and rate of events required to trigger this rule should be adjusted to meet organizational requirements

AIE Rule Name	HC: Multiple Door Access Failures
AIE Rule ID	1587
AIE Rule Brief Description	Observes for multiple failed door authentications
Classification	Audit : Access Failure
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An individual has failed multiple times at accessing a restricted room, office, elevator, etc. of a hospital via badge or biometric device

AIE Rule Name	HC: New Hardware Detected
AIE Rule ID	1588
AIE Rule Brief Description	Observes for connection of a new external device (e.g., USB drive, keyboard, mouse) to a system
Classification	Operations : Information
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An employee or adversary adds a new hardware device, such as a USB drive, keyboard, or mouse to a system

AIE Rule Name	HC: New Medical Device
AIE Rule ID	1589
AIE Rule Brief Description	Observes for a newly discovered medical device (e.g., infusion pump)
Classification	Operations : Information
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator adds a new infusion pump device to a hospital network

AIE Rule Name	HC: Sensor Connected/Disconnected
AIE Rule ID	1590
AIE Rule Brief Description	Observes for sensor connections/disconnections
Classification	Operations : Information
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare organization requires constant real-time visibility into the health status of all network-connected medical devices

AIE Rule Name	HC: SMBv1 Communication
AIE Rule ID	1591
AIE Rule Brief Description	Observes for device communication over SMBv1
Classification	Operations : Network Traffic
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary gains access to medical device and attempts to pivot to a network file server by creating an SMB session

AIE Rule Name	HC: Software Install/Update Failure
AIE Rule ID	1592
AIE Rule Brief Description	Observes for failed software installations/updates
Classification	Operations : Warning
Event Suppression Period	1
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator requires visibility into unsuccessful system software installations/updates

AIE Rule Name	HC: Software Installed/Updated
AIE Rule ID	1593
AIE Rule Brief Description	Observes for successful software installations/updates
Classification	Audit : Configuration
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator implements a successful medical device or system software installation/update

AIE Rule Name	HC: System Time Changed
AIE Rule ID	1594
AIE Rule Brief Description	Observes for system time changes
Classification	Audit : Other Audit Success
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: An adversary successfully compromises a system and then modifies the system time (via manual or automated malware actions) to obfuscate the timing of further activities

AIE Rule Name	HC: User Account Created
AIE Rule ID	1595
AIE Rule Brief Description	Observes for creation of a new user account
Classification	Audit : Account Created
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	Low
False Positive Probability	Low-Low
AIE Rule Additional Details	Use case: An adversary has created a local, domain, or cloud account on a hospital network to access specific services or establish secondary or admin/privileged user group accounts

AIE Rule Name	HC: Vulnerability Scan Event
AIE Rule ID	1596
AIE Rule Brief Description	Observes for vulnerability scans
Classification	Operations : Information
Event Suppression Period	60
Alarm on Event Occurrence	No
Environmental Dependency Factor	None
False Positive Probability	Medium-Medium
AIE Rule Additional Details	Use case: A healthcare systems administrator requires visibility into potential vulnerabilities of networked medical devices

Reports

Report Name	HC: AIE Alarm Summary
Class	Operations
Description	Report summarizes all Healthcare (OT) Module AI Engine Alarm Activity
Template Type	Executive Report
Data Source	Platform Manager