---
analysis: Static rules for process crashes are too noisy for medical environments.
  This hunt uses a phased approach, building confidence from software versions, exposure,
  and rare authenticated upload patterns before correlating with impact.
blind_spots:
- id: http-body-inspection
  question: Does the PNG/JPEG payload contain the specific malformed pitch header?
  requires: Full HTTP body logging or DPI
  risk: We see the upload event but cannot confirm it is malicious without seeing
    the image data.
  stage: exploit-delivery-upload
- id: no-crash-telemetry
  question: Was the process termination caused by the heap overflow or a manual service
    restart?
  requires: activity_id 2 for all processes or kernel crash logs
  risk: Legitimate maintenance could be flagged as a denial-of-service event.
  stage: impact-denial-of-service
coverage:
- stage: vulnerability-inventory
  status: covered
  steps:
  - find-vulnerable-orthanc
- stage: initial-access-vectors
  status: covered
  steps:
  - exposed-orthanc-services
  - orthanc-authentication
- stage: exploit-delivery-upload
  status: covered
  steps:
  - rare-uploader-prevalence
- reason: Tor activity is covered by existing rule dns_query_tor_onion.
  stage: network-traffic-obfuscation
  status: existing_rule
- stage: impact-denial-of-service
  status: covered
  steps:
  - orthanc-process-crashes
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Disruption to DICOM servers impacts clinical care. This hunt provides
    assurance that critical healthcare infrastructure is not being actively exploited
    via this high-severity heap overflow.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder exploits CVE-2026-87020 by uploading a malformed image to
  an authenticated session on a vulnerable Orthanc server, causing a heap overflow
  and process crash.
labels:
- hunt
- attack.t1190
- attack.t1090.003
- attack.t1133
- attack.t1566
- attack.t1499
name: Orthanc DICOM Server Vulnerability Exploitation
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-09-10'
      ref: hunt-standard
    type: number
  orthanc_keywords:
    default:
    - orthanc
    - dicom
    description: Keywords to identify Orthanc processes and packages.
    from:
      kind: article
      observed: '2026-09-10'
      ref: cisa-advisory
    type: list[string]
  scope_hosts:
    default: []
    description: List of hostnames to narrow the search; leave empty for all hosts.
    from:
      kind: manual
      observed: '2026-09-10'
      ref: analyst-defined
    type: list[host]
  upload_endpoints:
    default:
    - /instances/
    - ' /tools/preview/'
    - ' /dicom-web/'
    description: Known Orthanc image upload paths.
    from:
      kind: article
      observed: '2026-09-10'
      ref: orthanc-documentation
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-02
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on medical imaging VLANs and servers running DICOM services. The
  scoping query uses LIKE patterns to capture vulnerable versions (e.g., 1.12.x) that
  string comparisons often miss.
references:
- name: 'CISA Advisory: Orthanc DICOM Server'
  url: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-02
related:
- hunt: lateral-movement-from-clinical-assets
  reason: If an attacker crashes Orthanc, they may have already executed code and
    moved elsewhere.
  relation: follows
scenario:
  stages:
  - name: Initial Access & Credential Harvesting
    observables:
    - Unsolicited emails with malicious links or attachments
    - Remote access attempts via VPNs or exposed control systems
    slug: initial-access-vectors
    tactic: initial-access
    techniques:
    - T1566
    - T1133
  - name: Identification of Vulnerable Orthanc Server
    observables:
    - Orthanc DICOM Server versions < 1.13.0
    - CVE-2026-87020
    slug: vulnerability-inventory
    tactic: initial-access
    techniques:
    - T1190
  - name: Authenticated Malicious Image Upload
    observables:
    - Authenticated HTTP POST requests containing PNG or JPEG images
    - Communication with Orthanc DICOM service endpoints
    slug: exploit-delivery-upload
    tactic: initial-access
    techniques:
    - T1190
  - name: Multi-hop Proxying
    observables:
    - Traffic routed through multiple proxies or Tor to hide origin
    slug: network-traffic-obfuscation
    tactic: command-and-control
    techniques:
    - T1090.003
  - name: Process Crash and DoS
    observables:
    - Termination of Orthanc process
    - Heap out-of-bounds write leading to Orthanc service instability
    slug: impact-denial-of-service
    tactic: impact
    techniques:
    - T1499
  summary: Authenticated remote attackers exploit an integer overflow in Orthanc DICOM
    Server's image decoding logic (CVE-2026-87020) by providing malicious PNG or JPEG
    files. Successful exploitation triggers a heap out-of-bounds write that crashes
    the Orthanc process, resulting in a denial-of-service (DoS) condition.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Orthanc DICOM Server Vulnerability Exploitation

This hunt identifies vulnerable Orthanc DICOM Server instances and correlates authenticated image uploads with subsequent process terminations. The vulnerability is a heap out-of-bounds write triggered by integer overflows during image decoding. Because the exploit requires authentication, the hunt first establishes the risk surface through exposure and successful HTTP authentication events. It then stacks upload activity to find rare origins that precede service crashes.

## find-vulnerable-orthanc
<!-- Identify vulnerable Orthanc servers -->
Filter software inventory for Orthanc versions earlier than 1.13.0 using explicit version patterns.

```sqlite target=endpoint role=scoping params=(orthanc_keywords=orthanc_keywords)
~~~yaml
expected: A list of servers running affected versions. Silence confirms no vulnerable
  packages are registered.
reads:
- device_hostname
- install_path
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (instr(',' || '{{orthanc_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR LOWER(package_name) LIKE '%orthanc%') AND (package_version LIKE '1.12%' OR package_version LIKE '1.11%' OR package_version LIKE '1.10%' OR package_version LIKE '1.9%' OR package_version LIKE '0.%')
```

## early-risk-parallel
<!-- Exposure and access analysis -->
parallel:
- → exposed-orthanc-services
- → orthanc-authentication
join: → risk-assessment

## exposed-orthanc-services
<!-- Examine internet exposure -->
Check external scanner data for Orthanc instances visible from the public internet.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days)
~~~yaml
expected: Asset records for exposed servers. Silence means no public footprint was
  detected.
reads:
- discovered_at
- domain_or_ip
- port
- product
- source_product
- version
silence: not_evidence_of_absence
source: hb_exposed_assets
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT domain_or_ip, port, product, version, discovered_at FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%orthanc%' OR LOWER(source_product) LIKE '%orthanc%') AND discovered_at >= datetime('now', '-{{lookback_days}} days')
```

## orthanc-authentication
<!-- Detect successful HTTP authentication -->
Identify successful authenticated POST requests to the Orthanc server.

```sqlite target=web role=triage params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Successful authentication sessions. Authentication is a prerequisite for
  the CVE-2026-87020 exploit.
reads:
- device_hostname
- http_method
- src_endpoint_ip
- status_code
- time
- url_full
- url_path
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, src_endpoint_ip, url_full, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND http_method = 'POST' AND status_code = 200 AND (LOWER(url_path) LIKE '%auth%' OR LOWER(url_path) LIKE '%login%' OR LOWER(url_path) LIKE '%instances%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## risk-assessment
<!-- Triage early evidence -->
```agent target=hunter
cite: required
context:
- find-vulnerable-orthanc
- exposed-orthanc-services
- orthanc-authentication
max_iterations: 3
objective: Determine which vulnerable Orthanc servers are most at risk based on their
  version, exposure status, and the presence of authenticated traffic.
success_criteria: A summary per host citing vulnerable versions and evidence of external
  access.
tools:
- endpoint
- web
```

## exploitation-indicators-parallel
<!-- Correlate upload and crash activity -->
parallel:
- → rare-uploader-prevalence
- → orthanc-process-crashes
join: → exploitation-correlation

## rare-uploader-prevalence
<!-- Baseline rare image uploaders -->
Stack-count source IPs uploading images to find rare actors that might be delivering exploits.

```sqlite target=web role=baseline params=(scope_hosts=scope_hosts, upload_endpoints=upload_endpoints, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: One-off or rare source IPs performing uploads. Frequent uploaders are likely
  legitimate clinical tools.
prevalence:
  by: device_hostname
  key:
  - src_endpoint_ip
  - url_path
  rare_below: 5
reads:
- device_hostname
- http_method
- src_endpoint_ip
- time
- url_path
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, src_endpoint_ip, url_path, COUNT(*) AS request_count, MIN(time) AS first_upload FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND http_method = 'POST' AND instr(',' || '{{upload_endpoints}}' || ',', ',' || LOWER(url_path) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, url_path HAVING request_count < 20
```

## orthanc-process-crashes
<!-- Detect Orthanc service terminations -->
Find process termination events for Orthanc to identify potential DoS impact from exploitation.

```sqlite target=endpoint role=triage params=(scope_hosts=scope_hosts, orthanc_keywords=orthanc_keywords, lookback_days=lookback_days)
~~~yaml
expected: Orthanc process terminations. Silence means the service has remained stable
  during the window.
reads:
- activity_id
- device_hostname
- process_cmd_line
- process_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, process_cmd_line, activity_id, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id = 2 AND (instr(',' || '{{orthanc_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) LIKE '%orthanc%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## exploitation-correlation
<!-- Final exploitation assessment -->
```agent target=hunter
cite: required
context:
- risk-assessment
- rare-uploader-prevalence
- orthanc-process-crashes
max_iterations: 5
objective: Correlate the risk assessment with rare upload events and process terminations
  on the same host within a 10-minute window to confirm exploitation of CVE-2026-87020.
success_criteria: A per-host verdict of malicious, suspicious, or benign with cited
  rows.
tools:
- endpoint
- web
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the exploitation-correlation verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-affected-server
indeterminate: → analyst-manual-review
unavailable: → analyst-manual-review (blind_spot: no-crash-telemetry)
else: → patch-verification

## isolate-affected-server
<!-- Isolate compromised server -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host and block port 8042 at the network perimeter until the software is patched.
```
→ analyst-manual-review

## analyst-manual-review
<!-- Forensic log review -->
```manual target=analyst
Review Orthanc application logs for memory allocation errors. Identify the authenticated user account linked to the suspicious POST request.
```
→ patch-verification

## patch-verification
<!-- Verify software upgrade -->
```manual target=analyst
Confirm that all servers identified in the scoping phase have been updated to Orthanc v1.13.0.
```
→ end