{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "InterSystems IRIS for Health is a critical healthcare infrastructure asset. CVE-2026-111594 allows for cleartext transmission of credentials by default, creating an immediate risk of unauthorized access to sensitive medical data."
      },
      "name": "InterSystems IRIS Cleartext Credential Exposure and Access",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1133",
        "attack.t1566",
        "credential access",
        "initial access"
      ],
      "related": [
        {
          "hunt": "unencrypted-management-protocols",
          "reason": "This hunt targets IRIS specifically; a broader hunt for Telnet, HTTP, or other unencrypted protocols in medical environments is a sibling investigation.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard rule might flag the software version or an anomalous login separately; this hunt pivots from the specific vulnerability to network behavior (cleartext superserver traffic) and then to the resulting outcome (unauthorized sign-in), correlating evidence across three distinct surfaces to distinguish legitimate administrative access from credential-theft intrusions.",
      "coverage": [
        {
          "stage": "vulnerable-product-deployment",
          "steps": [
            "find-vulnerable-iris"
          ],
          "status": "covered"
        },
        {
          "stage": "cleartext-transmission-exploitation",
          "steps": [
            "superserver-traffic"
          ],
          "status": "covered"
        },
        {
          "stage": "unauthorized-remote-access",
          "steps": [
            "iris-host-logins"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Deployment of Affected InterSystems IRIS",
            "slug": "vulnerable-product-deployment",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "InterSystems IRIS for Health 2026.2.0.221",
              "InterSystems IRIS for Health 2026.1.0.235",
              "InterSystems IRIS for Health 2025.3.0.226",
              "CVE-2026-111594"
            ]
          },
          {
            "name": "Cleartext Transmission of Sensitive Information",
            "slug": "cleartext-transmission-exploitation",
            "tactic": "credential-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "TLS/SSL encryption turned off by default",
              "Cleartext transmission of sensitive data",
              "IRIS superserver communications"
            ]
          },
          {
            "name": "Unauthorized Access via Stolen Credentials",
            "slug": "unauthorized-remote-access",
            "tactic": "initial-access",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "Log into the device",
              "Use intercepted data to authenticate"
            ]
          }
        ],
        "summary": "CVE-2026-111594 describes a critical misconfiguration in InterSystems IRIS for Health where TLS/SSL encryption is disabled by default for the superserver. This enables attackers to intercept sensitive data transmitted in cleartext, including login credentials, and subsequently use those credentials to gain unauthorized access to the device."
      },
      "severity": "high",
      "rationale": "Focus on the Healthcare and Public Health sector environments where InterSystems IRIS for Health is likely deployed. Start by identifying servers with IRIS installed and checking for port 1972 exposure.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker intercepts cleartext credentials from InterSystems IRIS superserver traffic on port 1972 to gain unauthorized access to the environment.",
      "parameters": {
        "iris_port": {
          "from": {
            "ref": "ICSMA-26-295-01",
            "kind": "article",
            "observed": "2026-10-22"
          },
          "type": "number",
          "default": "1972",
          "description": "The default InterSystems IRIS Superserver port."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-entry",
            "kind": "manual",
            "observed": "2026-10-22"
          },
          "type": "list[host]",
          "default": [],
          "description": "Restrict investigation to these hostnames; leave empty to use results from the scoping step."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2026-10-22"
          },
          "type": "number",
          "default": "14",
          "description": "Days of historical telemetry to examine."
        },
        "vulnerable_versions": {
          "from": {
            "ref": "ICSMA-26-295-01",
            "kind": "article",
            "observed": "2026-10-22"
          },
          "type": "list[string]",
          "default": [
            "2026.2.0.221",
            "2026.1.0.235",
            "2025.3.0.226"
          ],
          "description": "Affected InterSystems IRIS for Health versions."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01",
          "name": "CISA Advisory ICSMA-26-295-01: InterSystems Corporation InterSystems IRIS for Health"
        }
      ],
      "blind_spots": [
        {
          "id": "no-inventory-data",
          "risk": "A host without EDR coverage or inventory reporting will be missed entirely, leaving unencrypted portals active.",
          "stage": "vulnerable-product-deployment",
          "question": "Are all InterSystems IRIS instances captured in the inventory?",
          "requires": "accurate hb_software_inventory from all medical devices"
        },
        {
          "id": "no-network-telemetry",
          "risk": "Lack of network flow data prevents identifying unencrypted traffic patterns that indicate credential exposure.",
          "stage": "cleartext-transmission-exploitation",
          "question": "Is superserver traffic visible at the host or network level?",
          "requires": "hb_network_connection with flow data for port 1972"
        },
        {
          "id": "iris-internal-auth",
          "risk": "Logins occurring inside the IRIS application that do not trigger OS-level authentication remain invisible to hb_auth_signin.",
          "stage": "unauthorized-remote-access",
          "question": "Does the sign-in data include application-internal IRIS logins?",
          "requires": "application-level IRIS audit logs"
        }
      ]
    },
    "name": "InterSystems IRIS Cleartext Credential Exposure and Access",
    "description": "This hunt identifies vulnerable deployments of InterSystems IRIS for Health where TLS/SSL is disabled by default on the superserver. The hunt first scopes the estate for affected software versions using inventory data. It then examines network traffic on the default superserver port to detect unencrypted communication patterns. Finally, an agent correlates these traffic spikes with authentication logs to identify unauthorized logins using potentially intercepted credentials."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "vulnerable-product-deployment",
            "steps": [
              "find-vulnerable-iris"
            ],
            "status": "covered"
          },
          {
            "stage": "cleartext-transmission-exploitation",
            "steps": [
              "superserver-traffic"
            ],
            "status": "covered"
          },
          {
            "stage": "unauthorized-remote-access",
            "steps": [
              "iris-host-logins"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An attacker intercepts cleartext credentials from InterSystems IRIS superserver traffic on port 1972 to gain unauthorized access to the environment.",
        "blind_spots": [
          {
            "id": "no-inventory-data",
            "risk": "A host without EDR coverage or inventory reporting will be missed entirely, leaving unencrypted portals active.",
            "stage": "vulnerable-product-deployment",
            "question": "Are all InterSystems IRIS instances captured in the inventory?",
            "requires": "accurate hb_software_inventory from all medical devices"
          },
          {
            "id": "no-network-telemetry",
            "risk": "Lack of network flow data prevents identifying unencrypted traffic patterns that indicate credential exposure.",
            "stage": "cleartext-transmission-exploitation",
            "question": "Is superserver traffic visible at the host or network level?",
            "requires": "hb_network_connection with flow data for port 1972"
          },
          {
            "id": "iris-internal-auth",
            "risk": "Logins occurring inside the IRIS application that do not trigger OS-level authentication remain invisible to hb_auth_signin.",
            "stage": "unauthorized-remote-access",
            "question": "Does the sign-in data include application-internal IRIS logins?",
            "requires": "application-level IRIS audit logs"
          }
        ],
        "scoping_notes": "Focus on the Healthcare and Public Health sector environments where InterSystems IRIS for Health is likely deployed. Start by identifying servers with IRIS installed and checking for port 1972 exposure.",
        "beyond_detection": "A standard rule might flag the software version or an anomalous login separately; this hunt pivots from the specific vulnerability to network behavior (cleartext superserver traffic) and then to the resulting outcome (unauthorized sign-in), correlating evidence across three distinct surfaces to distinguish legitimate administrative access from credential-theft intrusions."
      }
    },
    {
      "id": "find-vulnerable-iris",
      "type": "query",
      "label": "Identify vulnerable IRIS deployments",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, device_uid, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%intersystems iris%' AND instr(',' || '{{vulnerable_versions}}' || ',', ',' || package_version || ',') > 0",
        "surface": "hb_software_inventory",
        "description": "Locate hosts running affected versions of InterSystems IRIS for Health to scope the investigative window.",
        "expected_signal": "A list of hosts running affected versions. Zero rows indicates no vulnerable versions are present in current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable IRIS deployments",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, device_uid, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%intersystems iris%' AND instr(',' || '{{vulnerable_versions}}' || ',', ',' || package_version || ',') > 0",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running affected versions. Zero rows indicates no vulnerable versions are present in current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "evaluate-lead",
      "type": "analytic",
      "label": "Initial Lead Assessment",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "find-vulnerable-iris"
        ],
        "objective": "Identify the vulnerable IRIS hosts from the inventory results and determine if any warrant immediate prioritization.",
        "description": "Assess whether vulnerable InterSystems IRIS instances exist before running expensive network telemetry queries.",
        "max_iterations": 3,
        "expected_signal": "A list of confirmed target hostnames for deep analysis.",
        "success_criteria": "A clear decision on whether to proceed and which hosts to target."
      },
      "parents": [
        {
          "id": "find-vulnerable-iris"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Continue to Traffic Analysis",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "at least one host running a vulnerable version of InterSystems IRIS",
        "condition": "at least one host running a vulnerable version of InterSystems IRIS",
        "blind_spot": "no-inventory-data",
        "confidence": "high",
        "description": "Halt the hunt if no vulnerable software was found, preserving resources.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-lead"
        }
      ]
    },
    {
      "id": "superserver-traffic",
      "type": "query",
      "label": "Examine IRIS Superserver Traffic",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS connection_count, SUM(traffic_bytes) AS total_bytes, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_network_connection WHERE dst_endpoint_port = {{iris_port}} AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip ORDER BY total_bytes DESC",
        "surface": "hb_network_connection",
        "description": "Identify hosts with significant traffic on the default unencrypted port 1972.",
        "expected_signal": "Source IPs communicating with the IRIS hosts on port 1972. Heavy usage from unexpected external IPs suggests potential interception risks."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Examine IRIS Superserver Traffic",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "dst_endpoint_port",
          "traffic_bytes"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS connection_count, SUM(traffic_bytes) AS total_bytes, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_network_connection WHERE dst_endpoint_port = {{iris_port}} AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip ORDER BY total_bytes DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Source IPs communicating with the IRIS hosts on port 1972. Heavy usage from unexpected external IPs suggests potential interception risks.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "src_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "iris-host-logins",
      "type": "query",
      "label": "Correlate Sign-ins to IRIS Hosts",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT dst_endpoint_hostname, actor_user_name, src_endpoint_ip, auth_protocol, logon_type, status, time FROM hb_auth_signin WHERE status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "surface": "hb_auth_signin",
        "description": "Detect successful logins to vulnerable hosts that might follow credential interception.",
        "expected_signal": "Recent successful logins to the targeted hosts. Focus on logins where the source IP matches traffic patterns seen in the network step."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Correlate Sign-ins to IRIS Hosts",
        "reads": [
          "dst_endpoint_hostname",
          "actor_user_name",
          "src_endpoint_ip",
          "status_id"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT dst_endpoint_hostname, actor_user_name, src_endpoint_ip, auth_protocol, logon_type, status, time FROM hb_auth_signin WHERE status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Recent successful logins to the targeted hosts. Focus on logins where the source IP matches traffic patterns seen in the network step.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "triage-findings",
      "type": "analytic",
      "label": "Synthesize Evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "evaluate-lead",
          "superserver-traffic",
          "iris-host-logins"
        ],
        "objective": "Determine if any vulnerable IRIS host shows evidence of credential theft via unencrypted traffic and subsequent unauthorized sign-ins.",
        "description": "Correlate vulnerability, traffic, and authentication data to identify suspected compromises.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict citing specific rows that link unencrypted traffic to subsequent logins.",
        "success_criteria": "A final verdict of malicious, suspicious, or benign per host."
      },
      "parents": [
        {
          "id": "superserver-traffic",
          "kind": "merge"
        },
        {
          "id": "iris-host-logins",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-findings",
      "type": "checkpoint",
      "label": "Route on Triage Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-findings verdict is malicious for at least one host due to unauthorized logins correlating with superserver traffic",
        "condition": "the triage-findings verdict is malicious for at least one host due to unauthorized logins correlating with superserver traffic",
        "blind_spot": "no-network-telemetry",
        "confidence": "high",
        "description": "Initiate containment for high-confidence compromises or move to manual verification.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-findings"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Compromised Host",
      "config": {
        "target": "endpoint",
        "description": "Halt ongoing credential theft and prevent lateral movement from the suspected breachhead.",
        "instructions": "Isolate the compromised IRIS host and revoke any active sessions for accounts that logged in during the suspicious window.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-findings",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-review",
      "type": "task",
      "label": "Analyst Review and Verification",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent's logic and confirm if the traffic patterns correspond to legitimate management activity.",
        "instructions": "Review the correlated authentication and network traffic rows. Verify if the IRIS server uses TLS and confirm whether the source IP belongs to a known authorized administrator."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-findings",
          "branch": "default"
        },
        {
          "id": "route-findings",
          "branch": "on_unavailable"
        },
        {
          "id": "route-findings",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Remediation and Close Out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and ensure remediation steps are documented.",
        "instructions": "Document the findings. If systems are vulnerable but not compromised, recommend enabling TLS on the IRIS superserver. If evidence of compromise exists, follow standard IR procedures."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        },
        {
          "id": "manual-review"
        }
      ]
    }
  ]
}