{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Healthcare organizations face massive operational disruption costs from ransomware. Combining data leakage monitoring with encryption behavior provides a holistic view of current risks to patient care continuity."
      },
      "name": "Healthcare Data Leakage and Ransomware Impact",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1486",
        "attack.t1195",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "healthcare-cyberattacks-hit-harder-cost-more",
        "index": 2,
        "title": "Healthcare Cyberattacks Hit Harder, Cost More",
        "total": 2
      },
      "related": [
        {
          "hunt": "ai-phishing-and-social-engineering",
          "reason": "This hunt focuses on the high-impact aftermath of an intrusion (leakage and encryption), whereas phishing focuses on initial access.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "healthcare-identity-ai-supply-chain-hunt",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard detection rule might alert on a known ransomware extension, but this hunt pivots between AI data submission patterns and subtle file/process behavioral anomalies to find stealthy leakage and behavioral precursors to encryption.",
      "coverage": [
        {
          "stage": "ai-prompt-data-leakage",
          "steps": [
            "ai-interaction-lead",
            "evidence-triage"
          ],
          "status": "covered"
        },
        {
          "stage": "ransomware-encryption-for-impact",
          "steps": [
            "ransomware-file-spikes",
            "suspicious-binary-prevalence",
            "evidence-triage"
          ],
          "status": "covered"
        },
        {
          "stage": "ai-phishing-and-social-engineering",
          "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ai-vendor-supply-chain-risk",
          "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "healthcare-account-compromise",
          "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Enhanced Phishing and Social Engineering",
            "slug": "ai-phishing-and-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "AI-generated phishing emails",
              "Social engineering scams",
              "Phishing links in healthcare-themed messages"
            ]
          },
          {
            "name": "AI Vendor Supply Chain Risk",
            "slug": "ai-vendor-supply-chain-risk",
            "tactic": "initial-access",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "Compromised third-party AI vendor tools",
              "Manipulation of AI service delivery mechanisms"
            ]
          },
          {
            "name": "Healthcare Account Compromise",
            "slug": "healthcare-account-compromise",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Compromised healthcare worker accounts",
              "Unauthorized authentication events"
            ]
          },
          {
            "name": "Sensitive Data Leakage via AI Prompts",
            "slug": "ai-prompt-data-leakage",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Medical records submitted to AI chatbot prompts",
              "HTTP POST requests to AI service domains such as openai.com"
            ]
          },
          {
            "name": "Ransomware Encryption for Impact",
            "slug": "ransomware-encryption-for-impact",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Encryption of patient care data",
              "Clinical system unavailability",
              "Deployment of ransomware payloads"
            ]
          }
        ],
        "summary": "Healthcare organizations are facing an escalation in cyberattacks characterized by AI-enhanced phishing, compromised credentials, and supply chain vulnerabilities in AI vendors. These incidents frequently lead to operational disruptions through ransomware encryption of patient records or the unauthorized leakage of sensitive medical data via AI prompts."
      },
      "severity": "medium",
      "rationale": "Focus on clinician workstations, hospital administration hosts, and servers hosting Electronic Medical Record (EMR) databases. Use the initial AI interaction lead to identify high-risk hosts before running the expensive ransomware queries.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "Sensitive healthcare data is being leaked via AI chat prompts while ransomware actors prepare or execute high-impact encryption on clinical endpoints, potentially using the same AI interfaces to automate data analysis or extortion.",
      "parameters": {
        "ai_domains": {
          "from": {
            "ref": "Proofpoint \u2014 Healthcare Cyberattacks Hit Harder, Cost More",
            "kind": "article",
            "observed": "2026-10-13"
          },
          "type": "list[domain]",
          "default": [
            "openai.com",
            "anthropic.com",
            "claude.ai",
            "gemini.google.com",
            "chatgpt.com"
          ],
          "description": "Domains of AI services where sensitive data leakage via prompts might occur."
        },
        "scope_hosts": {
          "from": {
            "ref": "scoping-parameter",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[host]",
          "default": [],
          "description": "Limit the hunt to specific hosts identified in the lead; leave empty to scan the entire estate."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "number",
          "default": "14",
          "description": "Days of historical telemetry to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more",
          "name": "Proofpoint \u2014 Healthcare Cyberattacks Hit Harder, Cost More"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-endpoint-telemetry",
          "risk": "Legacy or proprietary medical systems may not support the telemetry required for file and process monitoring, leaving encryption events invisible.",
          "stage": "ransomware-encryption-for-impact",
          "question": "Are critical diagnostic machines without agents currently being encrypted?",
          "requires": "Endpoint agent coverage on all medical imaging and diagnostic systems"
        },
        {
          "id": "proxy-encryption-gap",
          "risk": "Without TLS termination, the hunt only sees the hostname and the POST method, not the presence of PII/PHI in the request body.",
          "stage": "ai-prompt-data-leakage",
          "question": "What specifically was sent in the prompt text?",
          "requires": "HTTPS inspection on corporate proxies"
        }
      ]
    },
    "name": "Healthcare Data Leakage and Ransomware Impact",
    "description": "This hunt identifies two concurrent risks in healthcare environments: the unauthorized submission of patient data to AI chatbots and the behavioral spikes associated with ransomware encryption. It begins by identifying hosts interacting with AI services via HTTP POST requests, then fans out to analyze massive file modification events and rare or detached processes on those same systems. An agent triages these signals to determine if a data leakage incident or an encryption event is in progress on clinician workstations."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "healthcare-cyberattacks-hit-harder-cost-more",
          "index": 2,
          "title": "Healthcare Cyberattacks Hit Harder, Cost More",
          "total": 2
        },
        "coverage": [
          {
            "stage": "ai-prompt-data-leakage",
            "steps": [
              "ai-interaction-lead",
              "evidence-triage"
            ],
            "status": "covered"
          },
          {
            "stage": "ransomware-encryption-for-impact",
            "steps": [
              "ransomware-file-spikes",
              "suspicious-binary-prevalence",
              "evidence-triage"
            ],
            "status": "covered"
          },
          {
            "stage": "ai-phishing-and-social-engineering",
            "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ai-vendor-supply-chain-risk",
            "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "healthcare-account-compromise",
            "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "Sensitive healthcare data is being leaked via AI chat prompts while ransomware actors prepare or execute high-impact encryption on clinical endpoints, potentially using the same AI interfaces to automate data analysis or extortion.",
        "blind_spots": [
          {
            "id": "missing-endpoint-telemetry",
            "risk": "Legacy or proprietary medical systems may not support the telemetry required for file and process monitoring, leaving encryption events invisible.",
            "stage": "ransomware-encryption-for-impact",
            "question": "Are critical diagnostic machines without agents currently being encrypted?",
            "requires": "Endpoint agent coverage on all medical imaging and diagnostic systems"
          },
          {
            "id": "proxy-encryption-gap",
            "risk": "Without TLS termination, the hunt only sees the hostname and the POST method, not the presence of PII/PHI in the request body.",
            "stage": "ai-prompt-data-leakage",
            "question": "What specifically was sent in the prompt text?",
            "requires": "HTTPS inspection on corporate proxies"
          }
        ],
        "scoping_notes": "Focus on clinician workstations, hospital administration hosts, and servers hosting Electronic Medical Record (EMR) databases. Use the initial AI interaction lead to identify high-risk hosts before running the expensive ransomware queries.",
        "beyond_detection": "A standard detection rule might alert on a known ransomware extension, but this hunt pivots between AI data submission patterns and subtle file/process behavioral anomalies to find stealthy leakage and behavioral precursors to encryption."
      }
    },
    {
      "id": "ai-interaction-lead",
      "type": "query",
      "label": "AI interaction via HTTP POST",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) as post_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND http_method = 'POST' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path",
        "surface": "hb_http_activity",
        "description": "Identify hosts sending data to AI services, which may contain sensitive medical records and establishes the initial scope.",
        "expected_signal": "The query returns specific hosts and the AI endpoints they are posting data to; high POST counts suggest frequent data submission. Silence implies no detectable interaction with the listed domains."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "AI interaction via HTTP POST",
        "reads": [
          "device_hostname",
          "http_method",
          "time",
          "url_hostname",
          "url_path"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) as post_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND http_method = 'POST' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path",
        "silence": "not_evidence_of_absence",
        "expected": "The query returns specific hosts and the AI endpoints they are posting data to; high POST counts suggest frequent data submission. Silence implies no detectable interaction with the listed domains.",
        "verified": "dry-run",
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "ransomware-file-spikes",
      "type": "query",
      "label": "Ransomware file activity spikes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, LOWER(process_name) as process_name_case, COUNT(*) as activity_count, MIN(time) as start_time, MAX(time) as end_time FROM hb_file_activity WHERE activity_id IN (1, 4, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, LOWER(process_name) HAVING activity_count > 500 ORDER BY activity_count DESC",
        "surface": "hb_file_activity",
        "description": "Find high-frequency file creation, deletion, and renaming events on suspected hosts that typify ransomware encryption.",
        "expected_signal": "A process on a scoped host touching hundreds of files within a short window indicates potential encryption. Silence suggests no massive file-churn on these hosts."
      },
      "parents": [
        {
          "id": "ai-interaction-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Ransomware file activity spikes",
        "reads": [
          "activity_id",
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, LOWER(process_name) as process_name_case, COUNT(*) as activity_count, MIN(time) as start_time, MAX(time) as end_time FROM hb_file_activity WHERE activity_id IN (1, 4, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, LOWER(process_name) HAVING activity_count > 500 ORDER BY activity_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A process on a scoped host touching hundreds of files within a short window indicates potential encryption. Silence suggests no massive file-churn on these hosts.",
        "verified": "dry-run",
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "suspicious-binary-prevalence",
      "type": "query",
      "label": "Suspicious binary prevalence",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_name) as process_name_case, process_path, COUNT(DISTINCT device_hostname) as host_count, MIN(time) as first_seen FROM hb_process_activity WHERE (on_disk = 0 OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '/tmp/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name), process_path HAVING host_count <= 2",
        "surface": "hb_process_activity",
        "description": "Identify rare processes or processes running from temporary paths on suspect hosts that may be acting as ransomware droppers or AI data exfiltrators.",
        "expected_signal": "Rare binaries or fileless processes running from atypical locations across very few scoped hosts. Silence means no suspicious process anomalies were detected on the scoped set."
      },
      "parents": [
        {
          "id": "ai-interaction-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Suspicious binary prevalence",
        "reads": [
          "device_hostname",
          "on_disk",
          "process_name",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_name) as process_name_case, process_path, COUNT(DISTINCT device_hostname) as host_count, MIN(time) as first_seen FROM hb_process_activity WHERE (on_disk = 0 OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '/tmp/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name), process_path HAVING host_count <= 2",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare binaries or fileless processes running from atypical locations across very few scoped hosts. Silence means no suspicious process anomalies were detected on the scoped set.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name",
            "process_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "evidence-triage",
      "type": "analytic",
      "label": "Triage AI leakage and encryption evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "ai-interaction-lead",
          "ransomware-file-spikes",
          "suspicious-binary-prevalence"
        ],
        "objective": "Determine if the observed HTTP POSTs to AI domains correlate with mass file activity or suspicious processes on the same host, indicating either sensitive data leakage or active ransomware impact.",
        "description": "Analyze the combined output of AI-bound HTTP requests, mass file changes, and suspicious processes to confirm an intrusion.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict of Malicious, Suspicious, or Benign based on the alignment of telemetry types.",
        "success_criteria": "The agent returns a verdict for every host that appeared in more than one query result."
      },
      "parents": [
        {
          "id": "ransomware-file-spikes",
          "kind": "merge"
        },
        {
          "id": "suspicious-binary-prevalence",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "impact-routing",
      "type": "checkpoint",
      "label": "Route on impact verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evidence-triage verdict is Malicious for at least one host due to active encryption or high-volume data posting",
        "condition": "the evidence-triage verdict is Malicious for at least one host due to active encryption or high-volume data posting",
        "blind_spot": "missing-endpoint-telemetry",
        "confidence": "high",
        "description": "Decide whether to isolate the endpoint based on the severity of the triaged evidence and the certainty of malicious activity.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evidence-triage"
        }
      ]
    },
    {
      "id": "isolate-endpoint",
      "type": "action",
      "label": "Isolate the endpoint",
      "config": {
        "target": "endpoint",
        "description": "Sever the host's network access to prevent continued data exfiltration or file encryption.",
        "instructions": "Isolate the host immediately to prevent continued exfiltration of medical records or further encryption of clinical data.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "impact-routing",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "incident-review",
      "type": "task",
      "label": "Incident review",
      "config": {
        "assignee": "analyst",
        "description": "Analyze the forensic details of the triage and isolation to understand the scope of the potential medical data leak.",
        "instructions": "Verify the contents of the AI interaction by checking proxy logs if decryption is available. Confirm the identity of the rare process found in the triage step. Oversee the recovery of any encrypted files from backup and notify the privacy officer."
      },
      "parents": [
        {
          "id": "impact-routing",
          "branch": "default"
        },
        {
          "id": "impact-routing",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-endpoint"
        }
      ]
    },
    {
      "id": "hunt-closure",
      "type": "task",
      "label": "Hunt closure",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt results when no immediate malicious activity is confirmed.",
        "instructions": "Document the baseline of AI domain usage in the organization. Recommend AI usage policies if leakage risks are high even if not currently malicious. Update the hunt parameters with any new AI services discovered."
      },
      "parents": [
        {
          "id": "impact-routing",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}