Threat Hunting in Healthcare: Starting With Realistic Hypotheses
Hunting is not searching logs and hoping. It is writing a falsifiable statement about attacker behaviour and testing it — and in a hospital the good hypotheses are specific to the estate.
GuardsArm Team
Security Experts
Threat hunting fails most often because nobody defined what was being hunted. An analyst is given a day, a SIEM and an instruction to "look for anything unusual", finds a great deal that is unusual and nothing that is malicious, and the programme is judged a waste of time.
Hunting is hypothesis-driven. You write a specific, falsifiable statement about what an attacker would be doing, then go and test whether it is true.
What a usable hypothesis looks like
| Too vague | Testable |
|---|---|
| "Look for lateral movement" | "An attacker with a clinical workstation foothold would use WMI or PsExec to reach the imaging VLAN. Are there such connections from workstation to modality subnets?" |
| "Check for exfiltration" | "Exfiltration from the PACS would appear as C-MOVE requests to a destination outside the known viewer list. Are there any?" |
| "Find persistence" | "Persistence on legacy Windows endpoints would most likely use scheduled tasks or run keys. Which endpoints gained one in the last 30 days?" |
| "Look for suspicious logins" | "A stolen locum credential would authenticate outside that locum's contracted dates. Any authentications after a contract end date?" |
The right-hand statements share three properties: they name a technique, they name a data source, and they can come back empty in a way that means something.
Hunts worth running in a hospital
These are specific to the estate and rarely covered by generic detection content:
- Medical device talking to a new peer. Device communication should be near- deterministic. Any modality contacting a host it has never contacted is worth a look, and this is the highest-signal hunt available on a clinical network.
- Authentication after contract end. Locums and agency staff have end dates. Authentication past that date is either a process failure or an intruder.
- Interface engine anomalies. HL7 volumes follow daily and weekly rhythms. A deviation outside that pattern is either a clinical incident or a data movement problem — both worth knowing.
- Break-glass clusters. Several break-glass events from one account or unit in a short window, outside a genuine emergency.
- Service accounts logging in interactively. They should never do this; when they do it is almost always an attacker using stolen credentials.
- DNS from device VLANs resolving names outside the vendor's domains — see DNS security.
The data you need before you start
Hunting is limited by telemetry. Before scheduling hunts, confirm you have and retain:
| Data | Minimum retention | Used for |
|---|---|---|
| Process creation with command line | 90 days | Persistence, lateral movement |
| Authentication (success and failure) | 1 year | Credential abuse, contract-end hunts |
| DNS queries with client IP | 90 days | Exfiltration, C2 |
| Network flow between segments | 90 days | Lateral movement |
| EHR audit trail | Per HIPAA retention | Record misuse |
| Device network behaviour | 90 days | The device-peer hunt |
Running the cycle
A hunt that finds nothing is still a success if it leaves a detection behind. You have established that a technique is not currently present and built the capability to notice if it appears tomorrow. That is a better outcome than a hunt that finds something and leaves no rule.
Making it sustainable
Hunting dies when it depends on spare capacity, because there is never spare capacity. What works:
- Scheduled time — a fixed half-day per week beats an aspirational programme
- A hypothesis backlog anyone can add to, so nobody starts from a blank page
- Rotation, so hunting is not one person's hobby that leaves when they do
- Findings reported regardless of outcome, including the empty ones
- New detections counted as the primary output metric
Measure hunts run, detections created and coverage gaps closed — not compromises found. Optimising for finding compromises rewards a poorly defended estate.
GuardsArm runs hypothesis-driven hunts in healthcare environments and builds hunt programmes that outlast the analyst who started them. Book a scoping call.
Written by GuardsArm Team
Our team of cybersecurity experts brings decades of combined experience in penetration testing, compliance auditing, and incident response. We're dedicated to helping organizations strengthen their security posture.
Take the next step on this topic
Talk to the GuardsArm team about how these services apply to your environment.
