GreySec PHI Scanner — Full Pipeline Report

Generated: 2026-05-04 15:37 | GreySec Security

Executive Summary

SourceTypeHIGHMEDLOWTotal
WinServer 2022 (192.168.68.20)Windows830048
Win10 Desktop (192.168.68.15)Windows438402,454
MSSQL GreySecPHI (localhost:14330)Database95014
TOTAL2141902,516

Note: Win10 total includes noise (Defender/Chocolatey). Real PHI: 4 SSNs from Patient_Records.txt on Desktop.

WinServer 2022 (192.168.68.20) — PHI_seed/ (Seeded)

5 files: insurance_claims.json, nurse_notes.log, patient_db_export.json, patient_email.txt (+ 1 duplicate)

TypeValueFileLine
SSN573-44-9281C:\phi_test\PHI_seed\insurance_claims.json?
SSN819-77-3341C:\phi_test\PHI_seed\insurance_claims.json?
SSN622-11-0099C:\phi_test\PHI_seed\insurance_claims.json?
SSN441-28-7763C:\phi_test\PHI_seed\insurance_claims.json?
MRN001881C:\phi_test\PHI_seed\insurance_claims.json?
MRN001882C:\phi_test\PHI_seed\insurance_claims.json?
MRN001883C:\phi_test\PHI_seed\insurance_claims.json?
MRN001884C:\phi_test\PHI_seed\insurance_claims.json?
Phone772-441-0091C:\phi_test\PHI_seed\insurance_claims.json?
Phone1154998722C:\phi_test\PHI_seed\insurance_claims.json?
Phone414) 555-0174C:\phi_test\PHI_seed\insurance_claims.json?
Phone992-448-1177C:\phi_test\PHI_seed\insurance_claims.json?
Phone1154998722C:\phi_test\PHI_seed\insurance_claims.json?
Phone513) 555-2288C:\phi_test\PHI_seed\insurance_claims.json?
Phone772-441-9914C:\phi_test\PHI_seed\insurance_claims.json?
Phone1154998722C:\phi_test\PHI_seed\insurance_claims.json?
Phone214) 555-6610C:\phi_test\PHI_seed\insurance_claims.json?
Phone992-441-8817C:\phi_test\PHI_seed\insurance_claims.json?
Phone1154998722C:\phi_test\PHI_seed\insurance_claims.json?
Phone206) 555-3390C:\phi_test\PHI_seed\insurance_claims.json?
SSN662-41-0039C:\phi_test\PHI_seed\nurse_notes.log?
MRN992241C:\phi_test\PHI_seed\nurse_notes.log?
Phone503) 555-9914C:\phi_test\PHI_seed\nurse_notes.log?
Phone772-441-0091C:\phi_test\PHI_seed\nurse_notes.log?
Phone425) 555-8821C:\phi_test\PHI_seed\nurse_notes.log?
Emailbeverly.moss@homeemail.netC:\phi_test\PHI_seed\nurse_notes.log?
Emaildavid.szymanski@microsoft.comC:\phi_test\PHI_seed\nurse_notes.log?
SSN573-44-9281C:\phi_test\PHI_seed\patient_db_export.json?
SSN819-77-3341C:\phi_test\PHI_seed\patient_db_export.json?
SSN622-11-0099C:\phi_test\PHI_seed\patient_db_export.json?
Phone414) 555-0174C:\phi_test\PHI_seed\patient_db_export.json?
Phone513) 555-2288C:\phi_test\PHI_seed\patient_db_export.json?
Phone214) 555-6610C:\phi_test\PHI_seed\patient_db_export.json?
Phone1154998722C:\phi_test\PHI_seed\patient_db_export.json?
Phone1154998722C:\phi_test\PHI_seed\patient_db_export.json?
Phone1154998722C:\phi_test\PHI_seed\patient_db_export.json?
Emailjwhitfield@email.comC:\phi_test\PHI_seed\patient_db_export.json?
Emailjobrien@gmail.comC:\phi_test\PHI_seed\patient_db_export.json?
Emailmrodriguez@texashealth.netC:\phi_test\PHI_seed\patient_db_export.json?
Phone503) 555-9914C:\phi_test\PHI_seed\patient_email.txt?
Phone312) 555-9912C:\phi_test\PHI_seed\patient_email.txt?
Phone312) 555-9913C:\phi_test\PHI_seed\patient_email.txt?
Emailbeverly.moss@homeemail.netC:\phi_test\PHI_seed\patient_email.txt?
Emailbeverly.moss@homeemail.netC:\phi_test\PHI_seed\patient_email.txt?
Emailrecords@midwestmed.orgC:\phi_test\PHI_seed\patient_email.txt?
Emailrecords@midwestmed.orgC:\phi_test\PHI_seed\patient_email.txt?
Emailbeverly.moss@homeemail.netC:\phi_test\PHI_seed\patient_email.txt?

Win10 Desktop (192.168.68.15) — Real PHI (Pre-existing)

TypeValueFileLine
SSN123-45-6789C:\Users\vagrant\Desktop\Patient_Records.txt?
SSN987-65-4321C:\Users\vagrant\Desktop\Patient_Records.txt?
SSN555-12-3456C:\Users\vagrant\Desktop\Patient_Records.txt?
SSN444-55-6666C:\Users\vagrant\Desktop\Patient_Records.txt?

MSSQL GreySecPHI (localhost:14330) — Seeded PHI in DB

TypeValueTableScore
SSN573-44-9281Patients0.50
SSN819-77-3341Patients0.50
SSN622-11-0099Patients0.50
SSN441-28-7763Patients0.50
SSN662-41-0039Patients0.50
SSN573-44-9281Claims0.50
SSN819-77-3341Claims0.50
SSN622-11-0099Claims0.50
SSN441-28-7763Claims0.50
EMAILjwhitfield@email.comPatients1.00
EMAILschen@midwestmed.orgPatients1.00
EMAILjobrien@gmail.comPatients1.00
EMAILmrodriguez@texashealth.netPatients1.00
EMAILrwashington@email.comPatients1.00

Deployment Methods

MethodTargetCredentialsStatus
WinRM NTLMWinServer 2022 (.20)administrator / vagrantWORKING
atsvc DCERPCWin10 Desktop (.15)labuser / LabPass123!WORKING
MSSQL + Presidiolocalhost:14330sa / GreySecDBTest1!WORKING
PowerShell ScriptC:\phi_test\N/A (agentless)WORKING