HC-DICOM-CSTORECollection

DICOM C-STORE Unauth Access

Most PACS / DICOM servers don't authenticate C-STORE/C-FIND on port 104/11112 — read or write medical images.

§ Where this technique fits

HC-DICOM-CSTORE is catalogued under the Collection tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Unauth DICOM PACS → mass medical-image exfil
PACS server accepts unauthenticated C-FIND / C-MOVE on port 104 / 11112. Query for every study, pull every image — exfil hundreds of thousands of patient scans + DICOM metadata (PII).
step 2 / 5

§ What commonly comes next

01
Account Discovery
T1087 · Discovery
seen 1×
02
Exfiltration Over C2 Channel
T1041 · Exfiltration
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Unauth DICOM PACS → mass medical-image exfil

§ What commonly comes next