{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Medical imaging infrastructure is a critical asset. Exposure to unauthenticated data destruction vulnerabilities represents a severe risk to patient care and regulatory compliance."
      },
      "name": "J4Care dcm4che Vulnerability Exposure",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1485",
        "attack.t1565",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "dicom-protocol-exploitation",
          "reason": "This hunt focuses on the REST/HTTP management interface vulnerabilities, not the binary DICOM protocol itself.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single detection rule might alert on a specific CVE string, but this hunt correlates the presence of the vulnerable software with rare management behavior and the subsequent physical deletion of DICOM files, providing the context an analyst needs to confirm impact.",
      "coverage": [
        {
          "stage": "vulnerability-exposure-and-discovery",
          "steps": [
            "identify-vulnerable-imaging-systems"
          ],
          "status": "covered"
        },
        {
          "stage": "unauthorized-rest-api-manipulation",
          "steps": [
            "rare-rest-api-access"
          ],
          "status": "covered"
        },
        {
          "stage": "malformed-jpeg-parsing",
          "reason": "The JPEG parser vulnerability involves malicious payloads in the HTTP body, which hb_http_activity does not capture.",
          "status": "not_visible",
          "blind_spot": "http-body-payloads"
        },
        {
          "stage": "data-destruction-and-manipulation",
          "steps": [
            "dicom-file-deletions"
          ],
          "status": "covered"
        },
        {
          "stage": "application-denial-of-service",
          "reason": "Process activity surfaces lack the granular CPU utilization metrics needed to distinguish an infinite loop from normal high-load processing.",
          "status": "not_visible"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Identification of Vulnerable Imaging Systems",
            "slug": "vulnerability-exposure-and-discovery",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "J4Care dcm4chee-arc-light version 5.35.1",
              "dcm4che-arc-light software installation",
              "Publicly exposed medical imaging interfaces on port 80 or 443"
            ]
          },
          {
            "name": "Unauthorized REST API Access",
            "slug": "unauthorized-rest-api-manipulation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "HTTP requests to storage status-change REST service",
              "DICOM instance location records changed to deletion-related states",
              "REST parameters set to TO_DELETE state"
            ]
          },
          {
            "name": "Exploitation of JPEG Parser",
            "slug": "malformed-jpeg-parsing",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Truncated JPEG streams sent to the application",
              "Specially crafted JPEG payloads targeting JPEGParser"
            ]
          },
          {
            "name": "Medical Data Destruction and Forgery",
            "slug": "data-destruction-and-manipulation",
            "tactic": "impact",
            "techniques": [
              "T1485",
              "T1565"
            ],
            "observables": [
              "PurgeStorageScheduler deleting DICOM objects from storage",
              "DICOM instance records remaining in database without corresponding files",
              "Injection of forged medical studies",
              "Reassignment of patient records in the database",
              "Overwriting of medical files on disk"
            ]
          },
          {
            "name": "Infinite Loop Denial of Service",
            "slug": "application-denial-of-service",
            "tactic": "impact",
            "techniques": [
              "T1498"
            ],
            "observables": [
              "High CPU utilization by dcm4chee-arc-light processes",
              "JPEGParser entering infinite loop states",
              "Application unresponsiveness or denial-of-service reports"
            ]
          }
        ],
        "summary": "Attackers can exploit multiple vulnerabilities in J4Care dcm4chee-arc-light medical imaging systems, including missing authorization in REST services and infinite loops in image parsing. Successful exploitation allows for the unauthorized deletion of medical images, disclosure of patient records, and the creation of denial-of-service conditions through resource exhaustion."
      },
      "severity": "high",
      "rationale": "The hunt should initially focus on systems identified as internet-facing or located in clinical networks. Use the software inventory to narrow the behavior queries to only affected assets.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is exploiting unauthenticated REST services or malformed JPEG parsing in dcm4chee-arc-light to delete medical records or cause a denial-of-service condition on exposed healthcare assets.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified as vulnerable; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for behavior."
        },
        "affected_version": {
          "type": "string",
          "default": "5.35.1",
          "description": "Vulnerable version of dcm4chee-arc-light."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02",
          "name": "CISA Advisory: J4Care dcm4che"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-http-telemetry",
          "risk": "An adversary could delete records without a trace in the HTTP surface, leaving only file-level evidence.",
          "stage": "unauthorized-rest-api-manipulation",
          "question": "whether unauthorized REST calls were made if logging is disabled or the proxy does not log the specific dcm4che path",
          "requires": "hb_http_activity or web server access logs"
        },
        {
          "id": "http-body-payloads",
          "risk": "The DoS component of the advisory cannot be directly proven from metadata alone; we only see the high CPU aftermath or app hang.",
          "stage": "malformed-jpeg-parsing",
          "question": "whether a specially crafted JPEG was sent to trigger the parser loop",
          "requires": "Deep packet inspection or full HTTP body logging"
        }
      ]
    },
    "name": "J4Care dcm4che Vulnerability Exposure",
    "description": "This hunt identifies medical imaging systems running vulnerable versions of J4Care dcm4chee-arc-light and looks for signs of exploitation. It focuses on unauthorized use of the storage status-change REST service (CVE-2026-97851) and evidence of DICOM file manipulation or deletion. Because these vulnerabilities allow for data destruction and forgery without authentication, the hunt baselines REST activity to identify rare or unauthorized interactions."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "vulnerability-exposure-and-discovery",
            "steps": [
              "identify-vulnerable-imaging-systems"
            ],
            "status": "covered"
          },
          {
            "stage": "unauthorized-rest-api-manipulation",
            "steps": [
              "rare-rest-api-access"
            ],
            "status": "covered"
          },
          {
            "stage": "malformed-jpeg-parsing",
            "reason": "The JPEG parser vulnerability involves malicious payloads in the HTTP body, which hb_http_activity does not capture.",
            "status": "not_visible",
            "blind_spot": "http-body-payloads"
          },
          {
            "stage": "data-destruction-and-manipulation",
            "steps": [
              "dicom-file-deletions"
            ],
            "status": "covered"
          },
          {
            "stage": "application-denial-of-service",
            "reason": "Process activity surfaces lack the granular CPU utilization metrics needed to distinguish an infinite loop from normal high-load processing.",
            "status": "not_visible"
          }
        ],
        "rationale": "An adversary is exploiting unauthenticated REST services or malformed JPEG parsing in dcm4chee-arc-light to delete medical records or cause a denial-of-service condition on exposed healthcare assets.",
        "blind_spots": [
          {
            "id": "missing-http-telemetry",
            "risk": "An adversary could delete records without a trace in the HTTP surface, leaving only file-level evidence.",
            "stage": "unauthorized-rest-api-manipulation",
            "question": "whether unauthorized REST calls were made if logging is disabled or the proxy does not log the specific dcm4che path",
            "requires": "hb_http_activity or web server access logs"
          },
          {
            "id": "http-body-payloads",
            "risk": "The DoS component of the advisory cannot be directly proven from metadata alone; we only see the high CPU aftermath or app hang.",
            "stage": "malformed-jpeg-parsing",
            "question": "whether a specially crafted JPEG was sent to trigger the parser loop",
            "requires": "Deep packet inspection or full HTTP body logging"
          }
        ],
        "scoping_notes": "The hunt should initially focus on systems identified as internet-facing or located in clinical networks. Use the software inventory to narrow the behavior queries to only affected assets.",
        "beyond_detection": "A single detection rule might alert on a specific CVE string, but this hunt correlates the presence of the vulnerable software with rare management behavior and the subsequent physical deletion of DICOM files, providing the context an analyst needs to confirm impact."
      }
    },
    {
      "id": "identify-vulnerable-imaging-systems",
      "type": "query",
      "label": "Identify vulnerable imaging systems",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%dcm4chee%' AND package_version = '{{affected_version}}'",
        "surface": "hb_software_inventory",
        "description": "Locate hosts running the specific version of dcm4chee-arc-light identified in the CISA advisory.",
        "expected_signal": "A list of hostnames and paths where the vulnerable software is installed. Silence indicates no hosts are running the target version."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable imaging systems",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "install_path",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%dcm4chee%' AND package_version = '{{affected_version}}'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames and paths where the vulnerable software is installed. Silence indicates no hosts are running the target version.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "rare-rest-api-access",
      "type": "query",
      "label": "Rare REST API access to storage services",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "web",
        "content": "SELECT url_path, url_query, src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/storage/status%' OR LOWER(url_path) LIKE '%/dcm4chee-arc/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY url_path, url_query, src_endpoint_ip HAVING host_count <= 3 ORDER BY host_count ASC, request_count DESC",
        "surface": "hb_http_activity",
        "description": "Stack-count HTTP requests to the storage status-change service to identify unauthorized or anomalous management activity.",
        "expected_signal": "Anomalous REST API calls targeting storage deletion or status change states from unexpected source IPs. Rare requests suggest unauthorized manipulation."
      },
      "parents": [
        {
          "id": "identify-vulnerable-imaging-systems"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare REST API access to storage services",
        "reads": [
          "url_path",
          "url_query",
          "src_endpoint_ip",
          "device_hostname",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT url_path, url_query, src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/storage/status%' OR LOWER(url_path) LIKE '%/dcm4chee-arc/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY url_path, url_query, src_endpoint_ip HAVING host_count <= 3 ORDER BY host_count ASC, request_count DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Anomalous REST API calls targeting storage deletion or status change states from unexpected source IPs. Rare requests suggest unauthorized manipulation.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "url_path",
            "url_query",
            "src_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "dicom-file-deletions",
      "type": "query",
      "label": "DICOM file deletions and overwrites",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE activity_id IN (4, 3) AND (LOWER(file_path) LIKE '%.dcm' OR LOWER(file_path) LIKE '%/dicom/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_file_activity",
        "description": "Corroborate REST API activity by identifying actual file system deletions of medical imaging data on the scoped hosts.",
        "expected_signal": "Rows indicating that the dcm4chee process or a related scheduler deleted or updated .dcm files on disk. Large-scale deletions on exposed hosts are high-confidence signals of exploitation."
      },
      "parents": [
        {
          "id": "rare-rest-api-access"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DICOM file deletions and overwrites",
        "reads": [
          "device_hostname",
          "process_name",
          "file_path",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE activity_id IN (4, 3) AND (LOWER(file_path) LIKE '%.dcm' OR LOWER(file_path) LIKE '%/dicom/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating that the dcm4chee process or a related scheduler deleted or updated .dcm files on disk. Large-scale deletions on exposed hosts are high-confidence signals of exploitation.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "analyze-exposure",
      "type": "analytic",
      "label": "Analyze exposed host behavior",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "identify-vulnerable-imaging-systems",
          "rare-rest-api-access",
          "dicom-file-deletions"
        ],
        "objective": "Determine if any host running vulnerable J4Care software shows unauthorized REST API interactions that correlate with DICOM file deletions or updates.",
        "description": "Analyze whether the vulnerable hosts show a pattern of unauthorized REST manipulation followed by actual file impact.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict of exposed-and-compromised, exposed-only, or benign.",
        "success_criteria": "A host-by-host assessment citing specific HTTP requests and corresponding file activity."
      },
      "parents": [
        {
          "id": "dicom-file-deletions"
        }
      ]
    },
    {
      "id": "route-findings",
      "type": "checkpoint",
      "label": "Route based on analysis",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The analysis shows unauthorized REST interactions paired with file deletions on at least one vulnerable host.",
        "condition": "The analysis shows unauthorized REST interactions paired with file deletions on at least one vulnerable host.",
        "blind_spot": "missing-http-telemetry",
        "confidence": "medium",
        "description": "Direct the analyst to either an immediate remediation review if exploitation is suspected or a standard close-out if the systems are simply vulnerable.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "analyze-exposure"
        }
      ]
    },
    {
      "id": "remediation-review",
      "type": "task",
      "label": "Remediation and vulnerability review",
      "config": {
        "assignee": "analyst",
        "description": "Execute emergency patching and audit medical data integrity.",
        "instructions": "Upgrade all dcm4chee-arc-light installations to version 5.35.2 or later. Review DICOM storage for missing objects where database records still exist. Check logs for the TO_DELETE parameter in REST calls."
      },
      "parents": [
        {
          "id": "route-findings",
          "branch": "on_supports"
        },
        {
          "id": "route-findings",
          "branch": "default"
        },
        {
          "id": "route-findings",
          "branch": "on_unavailable"
        }
      ]
    },
    {
      "id": "standard-close-out",
      "type": "task",
      "label": "Standard close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document the absence of exploitation while noting the vulnerability status.",
        "instructions": "Record the identified vulnerable versions. Schedule a standard maintenance window for patching. Monitor for new alerts on these systems."
      },
      "parents": [
        {
          "id": "route-findings",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}