Skip to main content
Skip table of contents

Healthcare (OT) - Module User Guide

This guide is meant to be used as a day-to-day reference for the Healthcare (OT) module's content. All the content included in this module is listed below, along with a detailed explanation, suggested response, and configuration and tuning notes.

Suppression Period: The Suppression Multiple in conjunction with the Suppression Period defines how much time must pass before the same AI Engine rule can be triggered again for the same set of criteria. Measured in minutes in this guide.

Environmental Dependence Factor: EDF is a high-level quantification of how much effort is required in configuration and tuning for an AI Engine rule to perform as expected. This setting has no impact on processing.

False Positive Probability: The False Positive Probability is used in Risk-Based Priority (RBP) calculation for AI Engine Rules. It estimates how likely the rule is to generate a false positive response. A value of "low" indicates the pattern the rule matches is almost always a true positive. However, a value of "high" indicates the pattern the rule matches is very likely to be a false positive.

Options range from 0 to 9 with:

  • 0 indicating the pattern the rule matched is almost always a true positive.
  • 9 indicating the pattern the rule matched is very likely to be a false positive.            

AIE Rules

AIE Rule Name

HC: Account Added To Privileged Group

AIE Rule ID

1567

AIE Rule Brief Description

Observes for an account added to an admin/privileged user group

Classification

Security : Suspicious

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

Low

False Positive Probability

Low-Medium

AIE Rule Additional Details

Use case:
An adversary has compromised a domain controller of a hospital network and created a new admin/privileged user group account

Configuration:
Population of the Privileged Groups list is required and, to maintain accuracy, a quarterly review of this list is recommended

AIE Rule Name

HC: Admin Password Modified

AIE Rule ID

1568

AIE Rule Brief Description

Observes for an admin/privileged user password modification

Classification

Security : Suspicious

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

Medium

False Positive Probability

Low-High

AIE Rule Additional Details

Use case:
An adversary has gained access to an admin account on a hospital network and changes the credentials of another admin account to gain access to other systems, applications, databases, and/or data

Configuration:
Population of the HC: Privileged Users list is required and, to maintain accuracy, a quarterly review of this list is recommended

Optional configuration:
To exclude system accounts from this alarm, add an exclude filter for an Origin Login or Account which matches this regular expression: \$$

AIE Rule Name

HC: Crit Application Config Change

AIE Rule ID

1569

AIE Rule Brief Description

Observes for changes to critical application configurations

Classification

Audit : Configuration

Event Suppression Period

1

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:
Monitor for planned/unplanned configuration changes to critical healthcare applications to prevent potential application downtime

Configuration:
Include Filters should be added to the rule block for critical hosts and/or applications/processes that are in scope for the analytic

AIE Rule Name

HC: Crit Backup Failure

AIE Rule ID

1570

AIE Rule Brief Description

Observes for failed critical backup events

Classification

Operations : Critical

Event Suppression Period

1

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:
Monitor for failed backup events to critical healthcare applications/systems to prevent potential data loss and downtime

Configuration:
Include Filters should be added to the rule block for critical backup hosts that are in scope for the analytic

AIE Rule Name

HC: Crit Database Config Change

AIE Rule ID

1571

AIE Rule Brief Description

Observes for changes to critical database configurations

Classification

Audit : Configuration

Event Suppression Period

1

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:
Monitor for changes to critical database systems to prevent potential disruption to clinical, laboratory, and research data

Configuration:
Include Filters should be added to the rule block for critical hosts and/or database objects that are in scope for the analytic

AIE Rule Name

HC: Crit Net Access Config Change

AIE Rule ID

1572

AIE Rule Brief Description

Observes for changes to critical network access configurations

Classification

Audit : Configuration

Event Suppression Period

1

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:
Monitor for changes to network access configurations to prevent potential disruption of network connectivity for critical applications and systems, such as patient remote monitoring

Configuration:
Include Filters should be added to the rule block for critical hosts and/or network segments that are in scope for the analytic

AIE Rule Name

HC: Crit Service Stopped

AIE Rule ID

1573

AIE Rule Brief Description

Observes for critical service stop events that are not followed by service start events

Classification

Operations : Critical

Event Suppression Period

5

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:
An employee has opened a document containing malware that has killed all active services on a medication administration system

Configuration:
Include Filters should be added to the rule block for critical log sources and services that are in scope for the analytic

AIE Rule Name

HC: Crit System Config Change

AIE Rule ID

1574

AIE Rule Brief Description

Observes for changes to critical system configurations

Classification

Audit : Configuration

Event Suppression Period

1

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:
A healthcare systems administrator implements a system configuration change that results in critical system downtime

Configuration:
Include Filters should be added to the rule block for critical hosts that are in scope for the analytic

AIE Rule Name

HC: Crit System Shutdown

AIE Rule ID

1575

AIE Rule Brief Description

Observes for critical system shutdowns that are not followed by startup activity

Classification

Audit : Startup and Shutdown

Event Suppression Period

30

Alarm on Event Occurrence

Yes

Environmental Dependency Factor

Medium

False Positive Probability

High-Low

AIE Rule Additional Details

Use case:
A critical medical device (e.g., infusion pump) connected to a hospital network shuts down and fails to restart automatically

Configuration:
Must be tuned to select "always on" hosts, along with identifying the appropriate timeframe for the system startup after shutdown activity; to reduce alarms from this rule, specific systems or an entity containing critical systems should be defined within the Primary Criteria for each block and Log Source Criteria for each block should be defined to limit alarms to specific critical systems

AIE Rule Name

HC: Data Copy To Removable Device

AIE Rule ID

1576

AIE Rule Brief Description

Observes for data transfer to a removable device (e.g., USB drive)

Classification

Audit : Access Success

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:
A malicious employee accesses a patient records database and downloads PHI details to a USB drive with the intent of selling the details on the Dark Web

Configuration:
Data Loss Defender (DLD) feature should be enabled for the endpoints in scope with this analytic (see https://docs.logrhythm.com/lrsiem/7.14.0/data-loss-defender-dld)

AIE Rule Name

HC: Default Or Weak Password

AIE Rule ID

1577

AIE Rule Brief Description

Observes for a default or weak password

Classification

Security : Vulnerability

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An adversary uses the hard-coded or default password of a medical device to force unscheduled downtime of the device

AIE Rule Name

HC: Device Modified

AIE Rule ID

1578

AIE Rule Brief Description

Observes for device modifications

Classification

Audit : Access Success

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A hospital systems administrator creates a new medical device network profile or moves a medical device to a new network group

AIE Rule Name

HC: Device Sent Plaintext Credentials

AIE Rule ID

1579

AIE Rule Brief Description

Observes for device transmission of a plaintext password

Classification

Security : Vulnerability

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An adversary conducting a man-in-the-middle attack on a hospital network obtains the password for a medical device

AIE Rule Name

HC: Device Software Vulnerability

AIE Rule ID

1580

AIE Rule Brief Description

Observes for device software vulnerabilities

Classification

Security : Vulnerability

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator has a requirement to identify medical devices affected by industry-specific recalls or security alerts

AIE Rule Name

HC: Door Access Granted

AIE Rule ID

1581

AIE Rule Brief Description

Observes for successful door authentications

Classification

Audit : Access Success

Event Suppression Period

30

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:

An individual successfully accesses a restricted room, office, elevator, etc. of a hospital via badge or biometric device

AIE Rule Name

HC: Expired Certificate

AIE Rule ID

1582

AIE Rule Brief Description

Observes for an expired TLS certificate

Classification

Operations : Warning

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A certificate for a critical cloud-based service that provides ongoing instructions to a ventilator system expires while fetching patient data to determine next course of action treatment

AIE Rule Name

HC: File Deletion Activity

AIE Rule ID

1583

AIE Rule Brief Description

Observes for file deletions

Classification

Security : Suspicious

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:
An adversary with compromised credentials accesses and deletes files within a biomedical research database

Configuration:
File Integrity Monitoring enablement required

AIE Rule Name

HC: Firmware Change

AIE Rule ID

1584

AIE Rule Brief Description

Observes for device firmware changes

Classification

Operations : Information

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An adversary with knowledge of a patient monitor hard-coded credentials vulnerability installs unauthorized firmware for malicious purposes

AIE Rule Name

HC: Malicious IP

AIE Rule ID

1585

AIE Rule Brief Description

Observes for device communication with a destination IP flagged as potentially malicious

Classification

Security : Other Security

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator requires insight into medical devices that are communicating with potentially malicious IP addresses

AIE Rule Name

HC: Multiple Account Lockouts

AIE Rule ID

1586

AIE Rule Brief Description

Observes for an account locked out multiple times (>=3) per hour

Classification

Audit : Access Revoked

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

Low

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:
An adversary conducts a brute force password attack attempting to access a system containing confidential patient clinical notes

Configuration:
The volume and rate of events required to trigger this rule should be adjusted to meet organizational requirements

AIE Rule Name

HC: Multiple Door Access Failures

AIE Rule ID

1587

AIE Rule Brief Description

Observes for multiple failed door authentications

Classification

Audit : Access Failure

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An individual has failed multiple times at accessing a restricted room, office, elevator, etc. of a hospital via badge or biometric device

AIE Rule Name

HC: New Hardware Detected

AIE Rule ID

1588

AIE Rule Brief Description

Observes for connection of a new external device (e.g., USB drive, keyboard, mouse) to a system

Classification

Operations : Information

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An employee or adversary adds a new hardware device, such as a USB drive, keyboard, or mouse to a system

AIE Rule Name

HC: New Medical Device

AIE Rule ID

1589

AIE Rule Brief Description

Observes for a newly discovered medical device (e.g., infusion pump)

Classification

Operations : Information

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator adds a new infusion pump device to a hospital network

AIE Rule Name

HC: Sensor Connected/Disconnected

AIE Rule ID

1590

AIE Rule Brief Description

Observes for sensor connections/disconnections

Classification

Operations : Information

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare organization requires constant real-time visibility into the health status of all network-connected medical devices

AIE Rule Name

HC: SMBv1 Communication

AIE Rule ID

1591

AIE Rule Brief Description

Observes for device communication over SMBv1

Classification

Operations : Network Traffic

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An adversary gains access to medical device and attempts to pivot to a network file server by creating an SMB session

AIE Rule Name

HC: Software Install/Update Failure

AIE Rule ID

1592

AIE Rule Brief Description

Observes for failed software installations/updates

Classification

Operations : Warning

Event Suppression Period

1

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator requires visibility into unsuccessful system software installations/updates

AIE Rule Name

HC: Software Installed/Updated

AIE Rule ID

1593

AIE Rule Brief Description

Observes for successful software installations/updates

Classification

Audit : Configuration

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator implements a successful medical device or system software installation/update

AIE Rule Name

HC: System Time Changed

AIE Rule ID

1594

AIE Rule Brief Description

Observes for system time changes

Classification

Audit : Other Audit Success

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

An adversary successfully compromises a system and then modifies the system time (via manual or automated malware actions) to obfuscate the timing of further activities

AIE Rule Name

HC: User Account Created

AIE Rule ID

1595

AIE Rule Brief Description

Observes for creation of a new user account

Classification

Audit : Account Created

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

Low

False Positive Probability

Low-Low

AIE Rule Additional Details

Use case:

An adversary has created a local, domain, or cloud account on a hospital network to access specific services or establish secondary or admin/privileged user group accounts

AIE Rule Name

HC: Vulnerability Scan Event

AIE Rule ID

1596

AIE Rule Brief Description

Observes for vulnerability scans

Classification

Operations : Information

Event Suppression Period

60

Alarm on Event Occurrence

No

Environmental Dependency Factor

None

False Positive Probability

Medium-Medium

AIE Rule Additional Details

Use case:

A healthcare systems administrator requires visibility into potential vulnerabilities of networked medical devices

Reports

Report Name

HC: AIE Alarm Summary

Class

Operations

Description

Report summarizes all Healthcare (OT) Module AI Engine Alarm Activity

Template Type

Executive Report

Data Source

Platform Manager

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.