{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Protecting healthcare worker identities and monitoring third-party AI supply chain interactions is critical for maintaining patient care continuity during a rise in sector-specific attacks." }, "name": "Healthcare Identity and AI Supply Chain Compromise", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1195", "attack.t1078", "impact", "initial access" ], "series": { "slug": "healthcare-cyberattacks-hit-harder-cost-more", "index": 1, "title": "Healthcare Cyberattacks Hit Harder, Cost More", "total": 2 }, "related": [ { "hunt": "ransomware-encryption-for-impact-detection", "reason": "This hunt focuses on initial access and identity; the encryption phase is a later stage of the impact cycle.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple rule can flag a failed login, but this hunt links those failures to the prevalence of rare web requests and specifically monitors the usage of cloud AI services to identify context-aware supply chain risks that isolated alerts miss.", "coverage": [ { "stage": "ai-phishing-and-social-engineering", "steps": [ "phishing-lure-traffic" ], "status": "covered" }, { "stage": "ai-vendor-supply-chain-risk", "steps": [ "unauthorized-ai-api-calls" ], "status": "covered" }, { "stage": "healthcare-account-compromise", "steps": [ "lead-auth-anomalies" ], "status": "covered" }, { "stage": "ai-prompt-data-leakage", "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.", "status": "out_of_scope" }, { "stage": "ransomware-encryption-for-impact", "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AI-Enhanced Phishing and Social Engineering", "slug": "ai-phishing-and-social-engineering", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "AI-generated phishing emails", "Social engineering scams", "Phishing links in healthcare-themed messages" ] }, { "name": "AI Vendor Supply Chain Risk", "slug": "ai-vendor-supply-chain-risk", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "Compromised third-party AI vendor tools", "Manipulation of AI service delivery mechanisms" ] }, { "name": "Healthcare Account Compromise", "slug": "healthcare-account-compromise", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "Compromised healthcare worker accounts", "Unauthorized authentication events" ] }, { "name": "Sensitive Data Leakage via AI Prompts", "slug": "ai-prompt-data-leakage", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "Medical records submitted to AI chatbot prompts", "HTTP POST requests to AI service domains such as openai.com" ] }, { "name": "Ransomware Encryption for Impact", "slug": "ransomware-encryption-for-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Encryption of patient care data", "Clinical system unavailability", "Deployment of ransomware payloads" ] } ], "summary": "Healthcare organizations are facing an escalation in cyberattacks characterized by AI-enhanced phishing, compromised credentials, and supply chain vulnerabilities in AI vendors. These incidents frequently lead to operational disruptions through ransomware encryption of patient records or the unauthorized leakage of sensitive medical data via AI prompts." }, "severity": "medium", "rationale": "Focus on accounts for healthcare practitioners and administrative staff who have access to sensitive patient systems. The lead query narrows the investigation to only those accounts showing immediate signs of identity risk, while the parallel queries allow for deep dives into phishing and AI supply chain interaction.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has compromised healthcare worker accounts via AI-crafted phishing to gain access to sensitive clinical portals or manipulate third-party AI service integrations.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-13" }, "type": "list[host]", "default": [], "description": "The list of hostnames identified in the lead query to scope the investigation." }, "lookback_days": { "from": { "ref": "default-retention", "kind": "manual", "observed": "2026-10-13" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "phishing_domains": { "from": { "ref": "proofpoint-healthcare-report-2026", "kind": "article", "observed": "2026-10-13" }, "type": "list[domain]", "default": [ "health-portal-verify.com", "care-staff-update.org", "clinical-sso-login.net" ], "description": "Healthcare-themed phishing domains from intelligence feeds." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more", "name": "Proofpoint \u2014 Healthcare Cyberattacks Hit Harder, Cost More" } ], "blind_spots": [ { "id": "auth-telemetry-gap", "risk": "A sign-in failure on a portal not sending logs to hb_auth_signin remains invisible.", "stage": "healthcare-account-compromise", "question": "whether an account was compromised on an unmonitored clinical portal", "requires": "centralized logging for specialized clinical portals" }, { "id": "http-retention-limit", "risk": "Adversaries often dwell in healthcare networks for weeks before initiating care disruption.", "stage": "ai-phishing-and-social-engineering", "question": "whether the initial phishing click occurred before the current 14-day retention window", "requires": "long-term hb_http_activity retention" } ] }, "name": "Healthcare Identity and AI Supply Chain Compromise", "description": "Healthcare organizations face increasing operational disruption from identity-driven attacks. This hunt uses a gated approach to identify suspicious authentication patterns\u2014such as high-volume failures or automated script-based logins\u2014before expanding into more expensive telemetry. If a lead is confirmed, the hunt fans out to investigate interactions with rare phishing domains and audits cloud API activity for unauthorized interactions with AI platforms like OpenAI, Bedrock, or Copilot, which may indicate supply chain risk or data exfiltration." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "healthcare-cyberattacks-hit-harder-cost-more", "index": 1, "title": "Healthcare Cyberattacks Hit Harder, Cost More", "total": 2 }, "coverage": [ { "stage": "ai-phishing-and-social-engineering", "steps": [ "phishing-lure-traffic" ], "status": "covered" }, { "stage": "ai-vendor-supply-chain-risk", "steps": [ "unauthorized-ai-api-calls" ], "status": "covered" }, { "stage": "healthcare-account-compromise", "steps": [ "lead-auth-anomalies" ], "status": "covered" }, { "stage": "ai-prompt-data-leakage", "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.", "status": "out_of_scope" }, { "stage": "ransomware-encryption-for-impact", "reason": "Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series.", "status": "out_of_scope" } ], "rationale": "An attacker has compromised healthcare worker accounts via AI-crafted phishing to gain access to sensitive clinical portals or manipulate third-party AI service integrations.", "blind_spots": [ { "id": "auth-telemetry-gap", "risk": "A sign-in failure on a portal not sending logs to hb_auth_signin remains invisible.", "stage": "healthcare-account-compromise", "question": "whether an account was compromised on an unmonitored clinical portal", "requires": "centralized logging for specialized clinical portals" }, { "id": "http-retention-limit", "risk": "Adversaries often dwell in healthcare networks for weeks before initiating care disruption.", "stage": "ai-phishing-and-social-engineering", "question": "whether the initial phishing click occurred before the current 14-day retention window", "requires": "long-term hb_http_activity retention" } ], "scoping_notes": "Focus on accounts for healthcare practitioners and administrative staff who have access to sensitive patient systems. The lead query narrows the investigation to only those accounts showing immediate signs of identity risk, while the parallel queries allow for deep dives into phishing and AI supply chain interaction.", "beyond_detection": "A simple rule can flag a failed login, but this hunt links those failures to the prevalence of rare web requests and specifically monitors the usage of cloud AI services to identify context-aware supply chain risks that isolated alerts miss." } }, { "id": "lead-auth-anomalies", "type": "query", "label": "Suspicious Authentication Leads", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail, COUNT(*) AS attempts, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE (status_id = 2 OR (user_agent IS NOT NULL AND (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%'))) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail HAVING attempts > 5 OR (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%') ORDER BY attempts DESC", "surface": "hb_auth_signin", "description": "Identify potential account compromise via high-frequency failures or automated login attempts.", "expected_signal": "Rows show repeated failures for specific users or sign-ins using non-browser user agents. Silence suggests no obvious automated account attacks." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Suspicious Authentication Leads", "reads": [ "device_hostname", "actor_user_name", "src_endpoint_ip", "user_agent", "status_detail", "time", "status_id" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail, COUNT(*) AS attempts, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE (status_id = 2 OR (user_agent IS NOT NULL AND (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%'))) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail HAVING attempts > 5 OR (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%') ORDER BY attempts DESC", "silence": "not_evidence_of_absence", "expected": "Rows show repeated failures for specific users or sign-ins using non-browser user agents. Silence suggests no obvious automated account attacks.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "evaluate-auth-lead", "type": "analytic", "label": "Assess Authentication Lead", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "lead-auth-anomalies" ], "objective": "Determine if the sign-in patterns in lead-auth-anomalies suggest active credential stuffing or unauthorized automation.", "description": "Decide if the authentication patterns warrant a deeper investigation into phishing and AI usage.", "max_iterations": 3, "expected_signal": "A per-user or per-IP verdict on whether the activity is suspicious.", "success_criteria": "A verdict of suspicious | benign for the detected accounts." }, "parents": [ { "id": "lead-auth-anomalies" } ] }, { "id": "gate-on-suspicion", "type": "checkpoint", "label": "Gate on Authentication Suspicion", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-auth-lead verdict is suspicious for at least one account or source IP", "condition": "the evaluate-auth-lead verdict is suspicious for at least one account or source IP", "blind_spot": "auth-telemetry-gap", "confidence": "high", "description": "Halt the hunt if the lead query does not produce credible evidence of compromise.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-auth-lead" } ] }, { "id": "phishing-lure-traffic", "type": "query", "label": "Phishing Lure Traffic", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR LOWER(url_path) LIKE '%/login%' OR LOWER(url_path) LIKE '%/verify%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path HAVING requests < 100 ORDER BY requests ASC", "surface": "hb_http_activity", "description": "Identify hosts interacting with rare or healthcare-themed phishing domains within the scoped set.", "expected_signal": "Rare domains appearing on fewer than 5 hosts matching phishing keywords. Silence means no suspicious web traffic was recorded on the scoped hosts." }, "parents": [ { "id": "gate-on-suspicion", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Phishing Lure Traffic", "reads": [ "url_hostname", "device_hostname", "url_path", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR LOWER(url_path) LIKE '%/login%' OR LOWER(url_path) LIKE '%/verify%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path HAVING requests < 100 ORDER BY requests ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare domains appearing on fewer than 5 hosts matching phishing keywords. Silence means no suspicious web traffic was recorded on the scoped hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_hostname" ], "rare_below": 5 }, "verified_at": "2026-10-14" } }, { "id": "unauthorized-ai-api-calls", "type": "query", "label": "Unauthorized AI API Activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT actor_user_name, api_service_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%bedrock%' OR LOWER(api_service_name) LIKE '%openai%' OR LOWER(api_service_name) LIKE '%copilot%' OR LOWER(api_service_name) LIKE '%sagemaker%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_cloud_api_activity", "description": "Detect healthcare accounts interacting with third-party AI services which may indicate supply chain manipulation.", "expected_signal": "Healthcare worker accounts performing API operations against cloud AI vendors. Silence suggests no such API activity was recorded." }, "parents": [ { "id": "gate-on-suspicion", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Unauthorized AI API Activity", "reads": [ "actor_user_name", "api_service_name", "api_operation", "resource_name", "src_endpoint_ip", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT actor_user_name, api_service_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%bedrock%' OR LOWER(api_service_name) LIKE '%openai%' OR LOWER(api_service_name) LIKE '%copilot%' OR LOWER(api_service_name) LIKE '%sagemaker%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Healthcare worker accounts performing API operations against cloud AI vendors. Silence suggests no such API activity was recorded.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "final-triage", "type": "analytic", "label": "Final Evidence Triage", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "evaluate-auth-lead", "phishing-lure-traffic", "unauthorized-ai-api-calls" ], "objective": "Determine if the fanned-out evidence confirms that the suspicious accounts from the lead query were used for malicious activity.", "description": "Correlate authentication leads with web prevalence and AI API usage to identify a full attack chain.", "max_iterations": 6, "expected_signal": "A comprehensive verdict linking compromised accounts to phishing interaction and subsequent AI service misuse.", "success_criteria": "A per-host/per-user verdict of malicious | suspicious | benign." }, "parents": [ { "id": "phishing-lure-traffic", "kind": "merge" }, { "id": "unauthorized-ai-api-calls", "kind": "merge" } ] }, { "id": "route-findings", "type": "checkpoint", "label": "Route Final Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host or user", "condition": "the final-triage verdict is malicious for at least one host or user", "blind_spot": "http-retention-limit", "confidence": "high", "description": "Direct the hunt to containment or close-out based on the triage findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Compromised Host", "config": { "target": "endpoint", "description": "Sever the attacker's connection and prevent further lateral movement.", "instructions": "Isolate the endpoint and disable the associated healthcare worker account in the identity provider.", "action_approval": "required" }, "parents": [ { "id": "route-findings", "branch": "on_supports" } ] }, { "id": "analyst-investigation", "type": "task", "label": "Analyst Investigation", "config": { "assignee": "analyst", "description": "Manually validate the findings and identify new indicators for future tuning.", "instructions": "Review the cited rows from authentication, HTTP, and cloud API activity. Verify if the rare domain traffic matches known clinical workflows or constitutes an intrusion. Check if the AI API calls align with approved vendor usage." }, "parents": [ { "id": "gate-on-suspicion", "branch": "default" }, { "id": "gate-on-suspicion", "branch": "on_unavailable" }, { "id": "route-findings", "branch": "default" }, { "id": "route-findings", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close Out Hunt", "config": { "assignee": "analyst", "description": "Document findings and visibility gaps to improve future healthcare resiliency.", "instructions": "Record the summary of findings and note any failures to monitor specific third-party AI services used by the organization. Document any hosts that were unscoped due to telemetry gaps." }, "parents": [ { "id": "gate-on-suspicion", "branch": "on_refutes" }, { "id": "route-findings", "branch": "on_refutes" }, { "id": "analyst-investigation" } ] } ] }