{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Cyber disruption to healthcare operations directly threatens patient safety. This hunt provides assurance that critical systems are not currently subject to the high-impact attack patterns (Ransomware, BEC, Supply Chain) highlighted in the 2026 report."
      },
      "name": "Healthcare Service Disruption and Data Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1195",
        "attack.t1041",
        "attack.t1486",
        "exfiltration",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "clinical-data-access-audit",
          "reason": "This hunt looks for mass exfiltration behavior; a sibling hunt is needed to audit individual credential access to database tables via application logs.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard detection rule might fire on a single rare process or a large file modification. This hunt correlates those signals across the entire attack lifecycle (Phishing -> Supply Chain -> Exfiltration -> Encryption) and uses clinical inventory context to distinguish maintenance from an intrusion.",
      "coverage": [
        {
          "stage": "initial-access-phishing-and-bec",
          "steps": [
            "phishing-signin-check"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-supply-chain",
          "steps": [
            "supply-chain-process-check"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-data-leakage",
          "steps": [
            "exfiltration-network-check"
          ],
          "status": "covered"
        },
        {
          "stage": "impact-ransomware-encryption",
          "steps": [
            "ransomware-file-burst"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Business Email Compromise and Phishing",
            "slug": "initial-access-phishing-and-bec",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Business email compromise (BEC) attempts",
              "AI-generated phishing",
              "Social engineering lures",
              "Unauthorized cloud account access"
            ]
          },
          {
            "name": "Supply Chain Compromise",
            "slug": "initial-access-supply-chain",
            "tactic": "initial-access",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "Compromised AI vendors",
              "Malicious software dependencies",
              "Untrusted third-party service integration"
            ]
          },
          {
            "name": "Data Exfiltration and Leakage",
            "slug": "exfiltration-data-leakage",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "Data leakage through AI prompts",
              "Exfiltration of sensitive healthcare information",
              "High-volume outbound network traffic",
              "Unauthorized file access"
            ]
          },
          {
            "name": "Ransomware Data Encryption",
            "slug": "impact-ransomware-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Mass file encryption",
              "Deployment of ransomware payloads",
              "Disruption of clinical applications",
              "Encryption of patient records"
            ]
          }
        ],
        "summary": "Healthcare organizations are facing a surge in cyberattacks\u2014including ransomware, supply chain compromises, and business email compromise\u2014that increasingly disrupt patient care and cause significant financial and operational strain. The rise of unsanctioned AI tools and vulnerable cloud accounts has further expanded the attack surface, leading to frequent data exfiltration and clinical service delays."
      },
      "severity": "medium",
      "rationale": "Start with hosts identified by the clinical_software_keywords list. Focus on Electronic Health Record (EHR) servers and diagnostic workstations. Ensure that domain controllers are included when assessing MFA-less sign-ins.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has gained access to clinical systems via phishing or supply chain compromise and is now exfiltrating patient data or preparing to deploy ransomware.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-output",
            "kind": "manual",
            "observed": "2026-10-13"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified in the scoping step; leave empty for a full-estate hunt."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-config",
            "kind": "manual",
            "observed": "2026-10-13"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "large_transfer_threshold": {
          "from": {
            "ref": "network-policy",
            "kind": "manual",
            "observed": "2026-10-13"
          },
          "type": "number",
          "default": "100000000",
          "description": "Threshold in bytes (default 100MB) for outbound network traffic volume."
        },
        "clinical_software_keywords": {
          "from": {
            "ref": "healthcare-software-list",
            "kind": "manual",
            "observed": "2026-10-13"
          },
          "type": "list[string]",
          "default": [
            "epic",
            "cerner",
            "meditech",
            "allscripts",
            "pacs",
            "dicom"
          ],
          "description": "Exact package names of clinical software to identify sensitive hosts."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.proofpoint.com/us/newsroom/press-releases/cyber-insecurity-in-healthcare-report-2026",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.proofpoint.com/us/newsroom/press-releases/cyber-insecurity-in-healthcare-report-2026",
          "name": "Proofpoint \u2014 Healthcare Sees No Relief from Cyberattacks Disrupting Patient Care"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-process-ancestry",
          "risk": "Short process command lines or truncated ancestry may hide the original injection point of a supply chain compromise.",
          "owner": "Endpoint Security",
          "stage": "initial-access-supply-chain",
          "question": "Did a legitimate clinical updater spawn the malicious child process?",
          "requires": "EDR process tree depth exceeding 10 levels",
          "remediation": "Increase EDR process telemetry depth and ensure full command line capture for clinical binaries."
        },
        {
          "id": "encrypted-exfiltration-visibility",
          "risk": "The current network connection surface only shows volume; it cannot see the content of HTTPS POST requests to AI service providers.",
          "owner": "Network Engineering",
          "stage": "exfiltration-data-leakage",
          "question": "Is sensitive patient data being leaked via AI prompts in encrypted HTTPS requests?",
          "requires": "hb_http_activity with decrypted payload visibility",
          "remediation": "Deploy TLS inspection on clinical segments to monitor for PII/PHI leakage via web services."
        }
      ]
    },
    "name": "Healthcare Service Disruption and Data Exfiltration",
    "description": "This hunt follows the attack lifecycle identified in the 2026 Cyber Insecurity in Healthcare report. It identifies critical healthcare assets and then monitors for signs of initial access, such as Business Email Compromise and supply chain anomalies. The hunt then pivots to detect high-volume exfiltration and the mass file encryption characteristic of ransomware, providing a phased assessment of the intrusion's progression on clinical hosts."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-phishing-and-bec",
            "steps": [
              "phishing-signin-check"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-supply-chain",
            "steps": [
              "supply-chain-process-check"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-data-leakage",
            "steps": [
              "exfiltration-network-check"
            ],
            "status": "covered"
          },
          {
            "stage": "impact-ransomware-encryption",
            "steps": [
              "ransomware-file-burst"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has gained access to clinical systems via phishing or supply chain compromise and is now exfiltrating patient data or preparing to deploy ransomware.",
        "blind_spots": [
          {
            "id": "missing-process-ancestry",
            "risk": "Short process command lines or truncated ancestry may hide the original injection point of a supply chain compromise.",
            "owner": "Endpoint Security",
            "stage": "initial-access-supply-chain",
            "question": "Did a legitimate clinical updater spawn the malicious child process?",
            "requires": "EDR process tree depth exceeding 10 levels",
            "remediation": "Increase EDR process telemetry depth and ensure full command line capture for clinical binaries."
          },
          {
            "id": "encrypted-exfiltration-visibility",
            "risk": "The current network connection surface only shows volume; it cannot see the content of HTTPS POST requests to AI service providers.",
            "owner": "Network Engineering",
            "stage": "exfiltration-data-leakage",
            "question": "Is sensitive patient data being leaked via AI prompts in encrypted HTTPS requests?",
            "requires": "hb_http_activity with decrypted payload visibility",
            "remediation": "Deploy TLS inspection on clinical segments to monitor for PII/PHI leakage via web services."
          }
        ],
        "scoping_notes": "Start with hosts identified by the clinical_software_keywords list. Focus on Electronic Health Record (EHR) servers and diagnostic workstations. Ensure that domain controllers are included when assessing MFA-less sign-ins.",
        "beyond_detection": "A standard detection rule might fire on a single rare process or a large file modification. This hunt correlates those signals across the entire attack lifecycle (Phishing -> Supply Chain -> Exfiltration -> Encryption) and uses clinical inventory context to distinguish maintenance from an intrusion."
      }
    },
    {
      "id": "discover-clinical-assets",
      "type": "query",
      "label": "Discover clinical assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE instr(',' || '{{clinical_software_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running healthcare applications to focus the hunt on systems where disruption would impact patient care.",
        "expected_signal": "A list of hosts running clinical software. Silence means no matching packages were found in inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Discover clinical assets",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE instr(',' || '{{clinical_software_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "silence": "evidence_of_absence",
        "expected": "A list of hosts running clinical software. Silence means no matching packages were found in inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "phishing-signin-check",
      "type": "query",
      "label": "Phishing and BEC sign-in check",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, src_location_country, mfa, time FROM hb_auth_signin WHERE status_id = 1 AND (mfa = 'false' OR mfa IS NULL) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "surface": "hb_auth_signin",
        "description": "Identify successful sign-ins to clinical hosts that bypassed MFA or originated from unusual sources.",
        "expected_signal": "A concentration of MFA-less logins on a single host. Rare source countries indicate potential account takeover."
      },
      "parents": [
        {
          "id": "discover-clinical-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Phishing and BEC sign-in check",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "src_endpoint_ip",
          "src_location_country",
          "mfa",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, src_location_country, mfa, time FROM hb_auth_signin WHERE status_id = 1 AND (mfa = 'false' OR mfa IS NULL) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A concentration of MFA-less logins on a single host. Rare source countries indicate potential account takeover.",
        "verified": "dry-run",
        "prevalence": {
          "by": "src_location_country",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "supply-chain-process-check",
      "type": "query",
      "label": "Clinical supply chain process check",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_path, process_name, parent_process_name, process_cmd_line, COUNT(*) as occurrence_count FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_path HAVING occurrence_count < 3 ORDER BY occurrence_count ASC",
        "surface": "hb_process_activity",
        "description": "Find rare processes on the scoped clinical hosts, which may indicate a supply-chain compromise where malware is disguised as normal system operations.",
        "expected_signal": "A rare binary path on a host that belongs to the clinical scope. Absence suggests only common fleet-wide binaries are running."
      },
      "parents": [
        {
          "id": "discover-clinical-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Clinical supply chain process check",
        "reads": [
          "device_hostname",
          "process_path",
          "process_name",
          "parent_process_name",
          "process_cmd_line",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_path, process_name, parent_process_name, process_cmd_line, COUNT(*) as occurrence_count FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_path HAVING occurrence_count < 3 ORDER BY occurrence_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A rare binary path on a host that belongs to the clinical scope. Absence suggests only common fleet-wide binaries are running.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Early stage triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "discover-clinical-assets",
          "phishing-signin-check",
          "supply-chain-process-check"
        ],
        "objective": "Determine if any host in the clinical scope shows signs of BEC or supply chain tampering based on the sign-in and process evidence.",
        "description": "Assess whether any clinical hosts show concurrent signs of access compromise before proceeding to search for impact.",
        "max_iterations": 4,
        "expected_signal": "A list of hosts with confirmed initial access indicators.",
        "success_criteria": "A per-host verdict of suspicious | benign for initial access stages."
      },
      "parents": [
        {
          "id": "phishing-signin-check",
          "kind": "merge"
        },
        {
          "id": "supply-chain-process-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "exfiltration-network-check",
      "type": "query",
      "label": "Exfiltration network check",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, traffic_bytes, process_name, time FROM hb_network_connection WHERE direction = 'outbound' AND traffic_bytes > {{large_transfer_threshold}} AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY traffic_bytes DESC",
        "surface": "hb_network_connection",
        "description": "Identify high-volume outbound network traffic to rare destinations from clinical hosts that may indicate data exfiltration.",
        "expected_signal": "Outbound flows exceeding 100MB to rare destination IPs. Absence of rows means no single flow met the threshold or all targets are fleet-wide common."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Exfiltration network check",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "traffic_bytes",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, traffic_bytes, process_name, time FROM hb_network_connection WHERE direction = 'outbound' AND traffic_bytes > {{large_transfer_threshold}} AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY traffic_bytes DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Outbound flows exceeding 100MB to rare destination IPs. Absence of rows means no single flow met the threshold or all targets are fleet-wide common.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "ransomware-file-burst",
      "type": "query",
      "label": "Ransomware file burst",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, activity_name, COUNT(*) as file_count, MIN(time) as burst_start FROM hb_file_activity WHERE activity_id IN (3, 4, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, activity_name HAVING file_count > 1000 ORDER BY file_count DESC",
        "surface": "hb_file_activity",
        "description": "Detect mass file modifications (renames or deletions) on clinical hosts that indicate ransomware encryption activity.",
        "expected_signal": "A single process modifying thousands of files. A hit suggests active encryption or data wiping."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Ransomware file burst",
        "reads": [
          "device_hostname",
          "process_name",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, activity_name, COUNT(*) as file_count, MIN(time) as burst_start FROM hb_file_activity WHERE activity_id IN (3, 4, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, activity_name HAVING file_count > 1000 ORDER BY file_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A single process modifying thousands of files. A hit suggests active encryption or data wiping.",
        "verified": "dry-run",
        "verified_at": "2026-10-14"
      }
    },
    {
      "id": "final-intrusion-assessment",
      "type": "analytic",
      "label": "Final intrusion assessment",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "early-stage-triage",
          "exfiltration-network-check",
          "ransomware-file-burst"
        ],
        "objective": "Synthesize findings from initial access triage with follow-on network exfiltration and ransomware file bursts to determine the severity and status of the intrusion.",
        "description": "Correlate early access signals with impact evidence to confirm a full intrusion chain threatening patient care.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict indicating if an active intrusion is in progress.",
        "success_criteria": "A final verdict of malicious | suspicious | benign per host, with a description of the attack stage."
      },
      "parents": [
        {
          "id": "exfiltration-network-check",
          "kind": "merge"
        },
        {
          "id": "ransomware-file-burst",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-intrusion-assessment verdict is malicious for at least one host",
        "condition": "the final-intrusion-assessment verdict is malicious for at least one host",
        "blind_spot": "missing-process-ancestry",
        "confidence": "high",
        "description": "Direct the response based on the agent's final assessment of the intrusion status.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-intrusion-assessment"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Immediately contain the suspected intrusion to prevent further exfiltration or encryption of clinical data.",
        "instructions": "Isolate the host and preserve its memory state for forensic analysis. Notify clinical operations of the system downtime.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-validation",
      "type": "task",
      "label": "Analyst validation",
      "config": {
        "assignee": "analyst",
        "description": "Perform manual review of the cited evidence to confirm the intrusion chain and update hunt parameters.",
        "instructions": "Review the clinical hosts identified. Verify if the network traffic and file activity are legitimate clinical operations or malicious behavior. Document tuning recommendations for the sign-in and file burst queries."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt by documenting results and any identified coverage gaps.",
        "instructions": "Record what was examined and what was not visible. If no intrusion was found, highlight the clinical systems that were verified as secure."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-validation"
        }
      ]
    }
  ]
}