---
analysis: A single detection rule might alert on a specific CVE string, but this hunt
  correlates the presence of the vulnerable software with rare management behavior
  and the subsequent physical deletion of DICOM files, providing the context an analyst
  needs to confirm impact.
blind_spots:
- id: missing-http-telemetry
  question: whether unauthorized REST calls were made if logging is disabled or the
    proxy does not log the specific dcm4che path
  requires: hb_http_activity or web server access logs
  risk: An adversary could delete records without a trace in the HTTP surface, leaving
    only file-level evidence.
  stage: unauthorized-rest-api-manipulation
- id: http-body-payloads
  question: whether a specially crafted JPEG was sent to trigger the parser loop
  requires: Deep packet inspection or full HTTP body logging
  risk: The DoS component of the advisory cannot be directly proven from metadata
    alone; we only see the high CPU aftermath or app hang.
  stage: malformed-jpeg-parsing
coverage:
- stage: vulnerability-exposure-and-discovery
  status: covered
  steps:
  - identify-vulnerable-imaging-systems
- stage: unauthorized-rest-api-manipulation
  status: covered
  steps:
  - rare-rest-api-access
- blind_spot: http-body-payloads
  reason: The JPEG parser vulnerability involves malicious payloads in the HTTP body,
    which hb_http_activity does not capture.
  stage: malformed-jpeg-parsing
  status: not_visible
- stage: data-destruction-and-manipulation
  status: covered
  steps:
  - dicom-file-deletions
- reason: Process activity surfaces lack the granular CPU utilization metrics needed
    to distinguish an infinite loop from normal high-load processing.
  stage: application-denial-of-service
  status: not_visible
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Medical imaging infrastructure is a critical asset. Exposure to unauthenticated
    data destruction vulnerabilities represents a severe risk to patient care and
    regulatory compliance.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is exploiting unauthenticated REST services or malformed
  JPEG parsing in dcm4chee-arc-light to delete medical records or cause a denial-of-service
  condition on exposed healthcare assets.
labels:
- hunt
- attack.t1190
- attack.t1485
- attack.t1565
- impact
- initial access
name: J4Care dcm4che Vulnerability Exposure
parameters:
  affected_version:
    default: 5.35.1
    description: Vulnerable version of dcm4chee-arc-light.
    type: string
  lookback_days:
    default: '14'
    description: Days of history to examine for behavior.
    type: number
  scope_hosts:
    default: []
    description: Hosts identified as vulnerable; leave empty to hunt across the entire
      estate.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: The hunt should initially focus on systems identified as internet-facing
  or located in clinical networks. Use the software inventory to narrow the behavior
  queries to only affected assets.
references:
- name: 'CISA Advisory: J4Care dcm4che'
  url: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
related:
- hunt: dicom-protocol-exploitation
  reason: This hunt focuses on the REST/HTTP management interface vulnerabilities,
    not the binary DICOM protocol itself.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Identification of Vulnerable Imaging Systems
    observables:
    - J4Care dcm4chee-arc-light version 5.35.1
    - dcm4che-arc-light software installation
    - Publicly exposed medical imaging interfaces on port 80 or 443
    slug: vulnerability-exposure-and-discovery
    tactic: initial-access
    techniques:
    - T1190
  - name: Unauthorized REST API Access
    observables:
    - HTTP requests to storage status-change REST service
    - DICOM instance location records changed to deletion-related states
    - REST parameters set to TO_DELETE state
    slug: unauthorized-rest-api-manipulation
    tactic: initial-access
    techniques:
    - T1190
  - name: Exploitation of JPEG Parser
    observables:
    - Truncated JPEG streams sent to the application
    - Specially crafted JPEG payloads targeting JPEGParser
    slug: malformed-jpeg-parsing
    tactic: initial-access
    techniques:
    - T1190
  - name: Medical Data Destruction and Forgery
    observables:
    - PurgeStorageScheduler deleting DICOM objects from storage
    - DICOM instance records remaining in database without corresponding files
    - Injection of forged medical studies
    - Reassignment of patient records in the database
    - Overwriting of medical files on disk
    slug: data-destruction-and-manipulation
    tactic: impact
    techniques:
    - T1485
    - T1565
  - name: Infinite Loop Denial of Service
    observables:
    - High CPU utilization by dcm4chee-arc-light processes
    - JPEGParser entering infinite loop states
    - Application unresponsiveness or denial-of-service reports
    slug: application-denial-of-service
    tactic: impact
    techniques:
    - T1498
  summary: Attackers can exploit multiple vulnerabilities in J4Care dcm4chee-arc-light
    medical imaging systems, including missing authorization in REST services and
    infinite loops in image parsing. Successful exploitation allows for the unauthorized
    deletion of medical images, disclosure of patient records, and the creation of
    denial-of-service conditions through resource exhaustion.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# J4Care dcm4che Vulnerability Exposure

This hunt identifies medical imaging systems running vulnerable versions of J4Care dcm4chee-arc-light and looks for signs of exploitation. It focuses on unauthorized use of the storage status-change REST service (CVE-2026-97851) and evidence of DICOM file manipulation or deletion. Because these vulnerabilities allow for data destruction and forgery without authentication, the hunt baselines REST activity to identify rare or unauthorized interactions.

## identify-vulnerable-imaging-systems
<!-- Identify vulnerable imaging systems -->
Locate hosts running the specific version of dcm4chee-arc-light identified in the CISA advisory.

```sqlite target=endpoint role=scoping params=(affected_version=affected_version)
~~~yaml
expected: A list of hostnames and paths where the vulnerable software is installed.
  Silence indicates no hosts are running the target version.
reads:
- device_hostname
- package_name
- package_version
- install_path
- vendor_name
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-10-16'
~~~
SELECT device_hostname, package_name, package_version, install_path, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%dcm4chee%' AND package_version = '{{affected_version}}'
```

## rare-rest-api-access
<!-- Rare REST API access to storage services -->
Stack-count HTTP requests to the storage status-change service to identify unauthorized or anomalous management activity.

```sqlite target=web role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Anomalous REST API calls targeting storage deletion or status change states
  from unexpected source IPs. Rare requests suggest unauthorized manipulation.
prevalence:
  by: device_hostname
  key:
  - url_path
  - url_query
  - src_endpoint_ip
  rare_below: 3
reads:
- url_path
- url_query
- src_endpoint_ip
- device_hostname
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-10-16'
~~~
SELECT url_path, url_query, src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/storage/status%' OR LOWER(url_path) LIKE '%/dcm4chee-arc/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY url_path, url_query, src_endpoint_ip HAVING host_count <= 3 ORDER BY host_count ASC, request_count DESC
```

## dicom-file-deletions
<!-- DICOM file deletions and overwrites -->
Corroborate REST API activity by identifying actual file system deletions of medical imaging data on the scoped hosts.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Rows indicating that the dcm4chee process or a related scheduler deleted
  or updated .dcm files on disk. Large-scale deletions on exposed hosts are high-confidence
  signals of exploitation.
reads:
- device_hostname
- process_name
- file_path
- activity_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-10-16'
~~~
SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE activity_id IN (4, 3) AND (LOWER(file_path) LIKE '%.dcm' OR LOWER(file_path) LIKE '%/dicom/%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## analyze-exposure
<!-- Analyze exposed host behavior -->
```agent target=hunter
cite: required
context:
- identify-vulnerable-imaging-systems
- rare-rest-api-access
- dicom-file-deletions
max_iterations: 3
objective: Determine if any host running vulnerable J4Care software shows unauthorized
  REST API interactions that correlate with DICOM file deletions or updates.
success_criteria: A host-by-host assessment citing specific HTTP requests and corresponding
  file activity.
tools:
- endpoint
- web
```

## route-findings
<!-- Route based on analysis -->
if~: "The analysis shows unauthorized REST interactions paired with file deletions on at least one vulnerable host." (confidence: medium, judge=hunter)
then: → remediation-review
indeterminate: → remediation-review
unavailable: → remediation-review (blind_spot: missing-http-telemetry)
else: → standard-close-out

## remediation-review
<!-- Remediation and vulnerability review -->
```manual target=analyst
Upgrade all dcm4chee-arc-light installations to version 5.35.2 or later. Review DICOM storage for missing objects where database records still exist. Check logs for the TO_DELETE parameter in REST calls.
```
→ end

## standard-close-out
<!-- Standard close-out -->
```manual target=analyst
Record the identified vulnerable versions. Schedule a standard maintenance window for patching. Monitor for new alerts on these systems.
```
→ end