{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Mirth Connect is critical infrastructure for healthcare data interchange; the identified vulnerabilities allow authenticated users to move from management API access to arbitrary code execution through file writes." }, "name": "NextGen Mirth Connect Exploitation and Exfiltration", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1041", "attack.t1133", "attack.t1566" ], "related": [ { "hunt": "mirth-connect-pre-auth-rce-v4-4", "reason": "Previous CVEs such as CVE-2023-43208 involved pre-authentication RCE which uses different management API paths.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A static rule might alert on a version string, but this hunt pivots between inventory, API traffic prevalence, and the behavioral aftermath of exploitation (unusual file writes from the service process) to distinguish active compromise from simple presence of the software.", "coverage": [ { "stage": "vulnerability-exposure-identification", "steps": [ "mirth-inventory" ], "status": "covered" }, { "stage": "authenticated-api-access", "steps": [ "rare-api-source-ips" ], "status": "covered" }, { "stage": "exploit-web-activity", "reason": "HTTP surfaces do not typically capture the POST bodies required to see SQL injection or XXE payloads.", "status": "not_visible", "blind_spot": "incomplete-http-visibility" }, { "stage": "post-exploit-impact", "steps": [ "mirth-file-writes" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Identification of Vulnerable Mirth Connect Instances", "slug": "vulnerability-exposure-identification", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Mirth Connect version <= 4.7.1", "Mirth Connect service exposure", "CVE-2026-82583", "CVE-2026-78224", "CVE-2026-82578" ] }, { "name": "Authenticated Access to Database Connector API", "slug": "authenticated-api-access", "tactic": "initial-access", "techniques": [ "T1133" ], "observables": [ "Authentication to Database Connector API", "Logins to Mirth Connect management interface" ] }, { "name": "SQL Injection and XXE Exploitation Traffic", "slug": "exploit-web-activity", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "Database Connector API requests containing SQL syntax", "XSLT Transformer Step configuration changes", "XML batch processing with XPath enabled", "HTTP POST requests with DOCTYPE or ENTITY tags", "Requests to /api/ (Mirth Connect API)" ] }, { "name": "Arbitrary File Write and Data Exfiltration", "slug": "post-exploit-impact", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Mirth Connect process (java.exe/mirth.exe) writing files to unexpected paths", "Outbound network connections from Mirth Connect server to external IPs", "DNS queries for out-of-band XXE exfiltration", "Extraction of stored credentials from connected systems" ] } ], "summary": "Attackers exploit SQL injection and XML External Entity (XXE) vulnerabilities in NextGen Healthcare Mirth Connect (v4.7.1 and earlier) to gain unauthorized access and exfiltrate data. Successful exploitation allows authenticated users to execute arbitrary SQL via the Database Connector API or trigger XXE flaws in XSLT and XML batch processing steps, leading to credential theft, arbitrary file writes, and data exfiltration." }, "severity": "high", "rationale": "Start by identifying all servers running Mirth Connect; narrow to those with Internet exposure via hb_exposed_assets if the estate is large.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is exploiting SQL injection or XXE vulnerabilities in NextGen Mirth Connect to exfiltrate credentials or write malicious files from the service process, typically identifiable by rare API traffic and unusual file system activity.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2026-09-10" }, "type": "list[host]", "default": [], "description": "Specific hostnames found in the scoping step; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-09-10" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "mirth_processes": { "from": { "ref": "product-documentation", "kind": "manual", "observed": "2026-09-10" }, "type": "list[string]", "default": [ "mirth.exe", "mcserver.exe", "java.exe", "java" ], "description": "Candidate process names for the Mirth Connect service." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01", "name": "CISA Advisory (ICSMA-26-253-01)" } ], "blind_spots": [ { "id": "incomplete-http-visibility", "risk": "The hunt can identify rare traffic but cannot see the exploit payload itself to confirm malicious intent before a file is written.", "stage": "exploit-web-activity", "question": "What specific SQL or XML payloads were sent to the /api/ endpoints?", "requires": "full HTTP POST body logging" }, { "id": "generic-java-process", "risk": "In environments with many Java-based services, file writes from java.exe may be noisy; command-line inspection is required to maintain fidelity.", "stage": "post-exploit-impact", "question": "Is the java.exe process definitively the Mirth Connect service?", "requires": "accurate process_cmd_line context" } ] }, "name": "NextGen Mirth Connect Exploitation and Exfiltration", "description": "NextGen Mirth Connect versions 4.7.1 and earlier are vulnerable to critical flaws including SQL injection (CVE-2026-82583) and XXE (CVE-2026-78224, CVE-2026-82578). These allow authenticated users to move from API access to full system compromise. This hunt identifies vulnerable instances, baselines the source IPs hitting management APIs, and searches for the behavioral aftermath of exploitation where the Mirth service process writes executable files or scripts to the host." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "vulnerability-exposure-identification", "steps": [ "mirth-inventory" ], "status": "covered" }, { "stage": "authenticated-api-access", "steps": [ "rare-api-source-ips" ], "status": "covered" }, { "stage": "exploit-web-activity", "reason": "HTTP surfaces do not typically capture the POST bodies required to see SQL injection or XXE payloads.", "status": "not_visible", "blind_spot": "incomplete-http-visibility" }, { "stage": "post-exploit-impact", "steps": [ "mirth-file-writes" ], "status": "covered" } ], "rationale": "An intruder is exploiting SQL injection or XXE vulnerabilities in NextGen Mirth Connect to exfiltrate credentials or write malicious files from the service process, typically identifiable by rare API traffic and unusual file system activity.", "blind_spots": [ { "id": "incomplete-http-visibility", "risk": "The hunt can identify rare traffic but cannot see the exploit payload itself to confirm malicious intent before a file is written.", "stage": "exploit-web-activity", "question": "What specific SQL or XML payloads were sent to the /api/ endpoints?", "requires": "full HTTP POST body logging" }, { "id": "generic-java-process", "risk": "In environments with many Java-based services, file writes from java.exe may be noisy; command-line inspection is required to maintain fidelity.", "stage": "post-exploit-impact", "question": "Is the java.exe process definitively the Mirth Connect service?", "requires": "accurate process_cmd_line context" } ], "scoping_notes": "Start by identifying all servers running Mirth Connect; narrow to those with Internet exposure via hb_exposed_assets if the estate is large.", "beyond_detection": "A static rule might alert on a version string, but this hunt pivots between inventory, API traffic prevalence, and the behavioral aftermath of exploitation (unusual file writes from the service process) to distinguish active compromise from simple presence of the software." } }, { "id": "mirth-inventory", "type": "query", "label": "Locate vulnerable Mirth Connect instances", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mirth%connect%' OR LOWER(package_name) LIKE '%nextgen%connect%') AND (package_version LIKE '4.7.1%' OR package_version LIKE '4.7.0%' OR package_version LIKE '4.6%' OR package_version LIKE '4.5%' OR package_version LIKE '4.4%' OR package_version LIKE '4.3%' OR package_version LIKE '4.2%' OR package_version LIKE '4.1%' OR package_version LIKE '4.0%' OR package_version LIKE '3.%' OR package_version LIKE '2.%' OR package_version LIKE '1.%')", "surface": "hb_software_inventory", "description": "Find hosts running Mirth Connect versions 4.7.1 or earlier to define the hunt scope.", "expected_signal": "A list of hosts and versions. Silence suggests no vulnerable versions are currently installed." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Locate vulnerable Mirth Connect instances", "reads": [ "device_hostname", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mirth%connect%' OR LOWER(package_name) LIKE '%nextgen%connect%') AND (package_version LIKE '4.7.1%' OR package_version LIKE '4.7.0%' OR package_version LIKE '4.6%' OR package_version LIKE '4.5%' OR package_version LIKE '4.4%' OR package_version LIKE '4.3%' OR package_version LIKE '4.2%' OR package_version LIKE '4.1%' OR package_version LIKE '4.0%' OR package_version LIKE '3.%' OR package_version LIKE '2.%' OR package_version LIKE '1.%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts and versions. Silence suggests no vulnerable versions are currently installed.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-api-source-ips", "type": "query", "label": "Baseline Mirth management API traffic", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (url_path LIKE '/api/channels%' OR url_path LIKE '/api/database%' OR url_path LIKE '/api/users%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC, request_count DESC", "surface": "hb_http_activity", "description": "Identify uncommon source IPs accessing Mirth management endpoints, which may indicate unauthorized authenticated access.", "expected_signal": "Source IPs that only target a single host. Normal administrative traffic usually originates from a consistent set of management subnets." }, "parents": [ { "id": "mirth-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Baseline Mirth management API traffic", "reads": [ "src_endpoint_ip", "device_hostname", "url_path", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (url_path LIKE '/api/channels%' OR url_path LIKE '/api/database%' OR url_path LIKE '/api/users%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC, request_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Source IPs that only target a single host. Normal administrative traffic usually originates from a consistent set of management subnets.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "src_endpoint_ip" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "mirth-file-writes", "type": "query", "label": "Find Mirth process file drops", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{mirth_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR process_cmd_line LIKE '%com.mirth.connect.server.Mirth%') AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '%.exe' OR LOWER(file_path) LIKE '%.jsp' OR LOWER(file_path) LIKE '%.ps1' OR LOWER(file_path) LIKE '%.bat' OR LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%\\webapps\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Search for the Mirth service process writing executable files or scripts, a high-confidence indicator of successful SQL injection exploitation.", "expected_signal": "The Mirth service writing new script or binary files. This process should rarely drop new executables outside of maintenance windows." }, "parents": [ { "id": "rare-api-source-ips" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Find Mirth process file drops", "reads": [ "device_hostname", "process_name", "process_cmd_line", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{mirth_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR process_cmd_line LIKE '%com.mirth.connect.server.Mirth%') AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '%.exe' OR LOWER(file_path) LIKE '%.jsp' OR LOWER(file_path) LIKE '%.ps1' OR LOWER(file_path) LIKE '%.bat' OR LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%\\webapps\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "The Mirth service writing new script or binary files. This process should rarely drop new executables outside of maintenance windows.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "analyze-exposure", "type": "analytic", "label": "Evaluate exploitation evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "mirth-inventory", "rare-api-source-ips", "mirth-file-writes" ], "objective": "Determine if any host running Mirth Connect v4.7.1 or earlier shows signs of active exploitation, focusing on the overlap between rare source IPs and suspicious file writes.", "description": "Correlate vulnerable versions, rare API access, and unusual file writes to determine host compromise status.", "max_iterations": 3, "expected_signal": "A per-host verdict citing specific rows from the preceding queries.", "success_criteria": "A verdict of malicious, suspicious, or benign for each identified Mirth host." }, "parents": [ { "id": "mirth-file-writes" } ] }, { "id": "route-findings", "type": "checkpoint", "label": "Route based on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent finds malicious or suspicious activity such as file writes or anomalous API access", "condition": "the agent finds malicious or suspicious activity such as file writes or anomalous API access", "blind_spot": "incomplete-http-visibility", "confidence": "medium", "description": "Direct the hunt to either forensic remediation for compromised hosts or patching for vulnerable ones.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "analyze-exposure" } ] }, { "id": "remediation-review", "type": "task", "label": "Forensic review and remediation", "config": { "assignee": "analyst", "description": "Perform manual review of suspicious files and ensure the Mirth instance is upgraded.", "instructions": "Collect and analyze any files identified in the behavioural step. Confirm all Mirth Connect instances are upgraded to v4.7.2 or later to mitigate the vulnerabilities." }, "parents": [ { "id": "route-findings", "branch": "on_supports" }, { "id": "route-findings", "branch": "default" }, { "id": "route-findings", "branch": "on_unavailable" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record exposure levels.", "instructions": "Document the number of vulnerable versus patched hosts. Record any findings of unauthorized access to the Database Connector API for future tuning." }, "parents": [ { "id": "route-findings", "branch": "on_refutes" }, { "id": "remediation-review" } ] } ] }