HC-HL7-INJECTImpact

HL7 v2 Message Injection

HL7 v2 messages are pipe-delimited cleartext — inject crafted segments into the unencrypted MLLP stream to alter lab results / orders.

§ Where this technique fits

HC-HL7-INJECT is catalogued under the Impact tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

MITM HL7 v2 → tamper lab orders / results
HL7 v2 over MLLP is plaintext pipe-delimited. From the same VLAN as the lab analyser ↔ EHR link, MITM and rewrite OBX result segments — changes the patient's documented test result.
step 4 / 5

§ What commonly comes next

01
Data Manipulation
T1565 · Impact
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MITM HL7 v2 → tamper lab orders / results

§ What commonly comes next