--- analysis: A simple rule can flag a failed login, but this hunt links those failures to the prevalence of rare web requests and specifically monitors the usage of cloud AI services to identify context-aware supply chain risks that isolated alerts miss. blind_spots: - id: auth-telemetry-gap question: whether an account was compromised on an unmonitored clinical portal requires: centralized logging for specialized clinical portals risk: A sign-in failure on a portal not sending logs to hb_auth_signin remains invisible. stage: healthcare-account-compromise - id: http-retention-limit question: whether the initial phishing click occurred before the current 14-day retention window requires: long-term hb_http_activity retention risk: Adversaries often dwell in healthcare networks for weeks before initiating care disruption. stage: ai-phishing-and-social-engineering coverage: - stage: ai-phishing-and-social-engineering status: covered steps: - phishing-lure-traffic - stage: ai-vendor-supply-chain-risk status: covered steps: - unauthorized-ai-api-calls - stage: healthcare-account-compromise status: covered steps: - lead-auth-anomalies - reason: Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series. stage: ai-prompt-data-leakage status: out_of_scope - reason: Belongs to another part of the 'Healthcare Cyberattacks Hit Harder, Cost More' series. stage: ransomware-encryption-for-impact status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Protecting healthcare worker identities and monitoring third-party AI supply chain interactions is critical for maintaining patient care continuity during a rise in sector-specific attacks. methodology: model-assisted trigger: intel-report hypothesis: An attacker has compromised healthcare worker accounts via AI-crafted phishing to gain access to sensitive clinical portals or manipulate third-party AI service integrations. labels: - hunt - attack.t1566 - attack.t1195 - attack.t1078 - impact - initial access name: Healthcare Identity and AI Supply Chain Compromise parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-10-13' ref: default-retention type: number phishing_domains: default: - health-portal-verify.com - care-staff-update.org - clinical-sso-login.net description: Healthcare-themed phishing domains from intelligence feeds. from: kind: article observed: '2026-10-13' ref: proofpoint-healthcare-report-2026 type: list[domain] scope_hosts: default: [] description: The list of hostnames identified in the lead query to scope the investigation. from: kind: manual observed: '2026-10-13' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on accounts for healthcare practitioners and administrative staff who have access to sensitive patient systems. The lead query narrows the investigation to only those accounts showing immediate signs of identity risk, while the parallel queries allow for deep dives into phishing and AI supply chain interaction. references: - name: "Proofpoint \u2014 Healthcare Cyberattacks Hit Harder, Cost More" url: https://www.proofpoint.com/us/newsroom/news/healthcare-cyberattacks-hit-harder-cost-more related: - hunt: ransomware-encryption-for-impact-detection reason: This hunt focuses on initial access and identity; the encryption phase is a later stage of the impact cycle. relation: out-of-scope-alternative scenario: stages: - name: AI-Enhanced Phishing and Social Engineering observables: - AI-generated phishing emails - Social engineering scams - Phishing links in healthcare-themed messages slug: ai-phishing-and-social-engineering tactic: initial-access techniques: - T1566 - name: AI Vendor Supply Chain Risk observables: - Compromised third-party AI vendor tools - Manipulation of AI service delivery mechanisms slug: ai-vendor-supply-chain-risk tactic: initial-access techniques: - T1195 - name: Healthcare Account Compromise observables: - Compromised healthcare worker accounts - Unauthorized authentication events slug: healthcare-account-compromise tactic: initial-access techniques: - T1566 - name: Sensitive Data Leakage via AI Prompts observables: - Medical records submitted to AI chatbot prompts - HTTP POST requests to AI service domains such as openai.com slug: ai-prompt-data-leakage tactic: initial-access techniques: - T1566 - name: Ransomware Encryption for Impact observables: - Encryption of patient care data - Clinical system unavailability - Deployment of ransomware payloads slug: ransomware-encryption-for-impact tactic: impact techniques: - T1486 summary: Healthcare organizations are facing an escalation in cyberattacks characterized by AI-enhanced phishing, compromised credentials, and supply chain vulnerabilities in AI vendors. These incidents frequently lead to operational disruptions through ransomware encryption of patient records or the unauthorized leakage of sensitive medical data via AI prompts. series: index: 1 slug: healthcare-cyberattacks-hit-harder-cost-more title: Healthcare Cyberattacks Hit Harder, Cost More total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Healthcare Identity and AI Supply Chain Compromise Healthcare organizations face increasing operational disruption from identity-driven attacks. This hunt uses a gated approach to identify suspicious authentication patterns—such as high-volume failures or automated script-based logins—before expanding into more expensive telemetry. If a lead is confirmed, the hunt fans out to investigate interactions with rare phishing domains and audits cloud API activity for unauthorized interactions with AI platforms like OpenAI, Bedrock, or Copilot, which may indicate supply chain risk or data exfiltration. ## lead-auth-anomalies Identify potential account compromise via high-frequency failures or automated login attempts. ```sqlite target=identity role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: Rows show repeated failures for specific users or sign-ins using non-browser user agents. Silence suggests no obvious automated account attacks. reads: - device_hostname - actor_user_name - src_endpoint_ip - user_agent - status_detail - time - status_id silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-14' ~~~ SELECT device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail, COUNT(*) AS attempts, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE (status_id = 2 OR (user_agent IS NOT NULL AND (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%'))) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, src_endpoint_ip, user_agent, status_detail HAVING attempts > 5 OR (LOWER(user_agent) LIKE '%python%' OR LOWER(user_agent) LIKE '%script%') ORDER BY attempts DESC ``` ## evaluate-auth-lead ```agent target=hunter cite: required context: - lead-auth-anomalies max_iterations: 3 objective: Determine if the sign-in patterns in lead-auth-anomalies suggest active credential stuffing or unauthorized automation. success_criteria: A verdict of suspicious | benign for the detected accounts. tools: - endpoint - identity - web ``` ## gate-on-suspicion if~: "the evaluate-auth-lead verdict is suspicious for at least one account or source IP" (confidence: high, judge=hunter) then: → investigate-surfaces indeterminate: → analyst-investigation unavailable: → analyst-investigation (blind_spot: auth-telemetry-gap) else: → close-out ## investigate-surfaces parallel: - → phishing-lure-traffic - → unauthorized-ai-api-calls join: → final-triage ## phishing-lure-traffic Identify hosts interacting with rare or healthcare-themed phishing domains within the scoped set. ```sqlite target=web role=baseline params=(phishing_domains=phishing_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare domains appearing on fewer than 5 hosts matching phishing keywords. Silence means no suspicious web traffic was recorded on the scoped hosts. prevalence: by: device_hostname key: - url_hostname rare_below: 5 reads: - url_hostname - device_hostname - url_path - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-10-14' ~~~ SELECT device_hostname, url_hostname, url_path, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR LOWER(url_path) LIKE '%/login%' OR LOWER(url_path) LIKE '%/verify%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path HAVING requests < 100 ORDER BY requests ASC ``` ## unauthorized-ai-api-calls Detect healthcare accounts interacting with third-party AI services which may indicate supply chain manipulation. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days) ~~~yaml expected: Healthcare worker accounts performing API operations against cloud AI vendors. Silence suggests no such API activity was recorded. reads: - actor_user_name - api_service_name - api_operation - resource_name - src_endpoint_ip - time silence: not_evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-10-14' ~~~ SELECT actor_user_name, api_service_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%bedrock%' OR LOWER(api_service_name) LIKE '%openai%' OR LOWER(api_service_name) LIKE '%copilot%' OR LOWER(api_service_name) LIKE '%sagemaker%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## final-triage ```agent target=hunter cite: required context: - evaluate-auth-lead - phishing-lure-traffic - unauthorized-ai-api-calls max_iterations: 6 objective: Determine if the fanned-out evidence confirms that the suspicious accounts from the lead query were used for malicious activity. success_criteria: A per-host/per-user verdict of malicious | suspicious | benign. tools: - endpoint - identity - web ``` ## route-findings if~: "the final-triage verdict is malicious for at least one host or user" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-investigation unavailable: → analyst-investigation (blind_spot: http-retention-limit) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the endpoint and disable the associated healthcare worker account in the identity provider. ``` → analyst-investigation ## analyst-investigation ```manual target=analyst Review the cited rows from authentication, HTTP, and cloud API activity. Verify if the rare domain traffic matches known clinical workflows or constitutes an intrusion. Check if the AI API calls align with approved vendor usage. ``` → close-out ## close-out ```manual target=analyst Record the summary of findings and note any failures to monitor specific third-party AI services used by the organization. Document any hosts that were unscoped due to telemetry gaps. ``` → end