ChipSoft HiX EHR Software Detection — Supply Chain Risk Assessment (CVE-2026-4404 Adjacent)
This detection identifies the presence of ChipSoft HiX electronic health record (EHR) software within the environment. ChipSoft is the dominant EHR provider in the Netherlands (~70% market share in Dutch healthcare). On April 7, 2026, ChipSoft was hit by a ransomware attack affecting HiX on-premise, HiX SaaS, and the SaaS patient portal. Z-CERT (Dutch healthcare CERT) advised all customers to immediately disconnect VPN connections to ChipSoft and intensively monitor network traffic. This KQL detection covers 3 areas: 1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM 2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days 3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
Microsoft Sentinel (KQL)
