ABB B&R Automation Runtime DoS Vulnerability in SDM — Detection and Hardening Guide

---
title: ABB B&R Automation Runtime Unexpected Service Termination
id: 9a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects unexpected termination of ABB B&R Automation Runtime processes which may indicate exploitation of the SDM DoS vulnerability.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-04
author: Security Arsenal
date: 2025/07/08
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'AR_Runtime'
      - 'B&R'
    CommandLine|contains:
      - 'stop'
      - 'terminate'
  filter:
    ParentImage|contains:
      - 'Installer'
      - 'UpdateService'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative shutdown
  - Scheduled maintenance
level: high
---
title: ABB B&R SDM Abnormal Resource Access Pattern
id: 8b2e1d71-8d3a-3c56-ab01-2d4a7e801234
status: experimental
description: Detects abnormal access patterns to the System Diagnostics Manager (SDM) that may indicate attempts to exploit improper resource locking.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-04
author: Security Arsenal
date: 2025/07/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 4800
      - 6600
    DestinationHostname|contains:
      - 'SDM'
      - 'Diagnostics'
  filter:
    SourceHostname|contains:
      - 'Admin'
      - 'Management'
      - 'SCADA'
  condition: selection and not filter
falsepositives:
  - Legitimate diagnostic operations
  - Authorized maintenance connections
level: medium

// Hunt for unexpected terminations of ABB B&R Automation Runtime
let ProcessEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoProductName has_any ("Automation Runtime", "B&R", "AR_Runtime")
| where ActionType in ("ProcessTerminated", "ProcessStopped")
| extend Details = pack("ProcessName", FileName, "CommandLine", ProcessCommandLine, "AccountName", AccountName);
let SystemEvents = DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "DeviceCrash" and DeviceName has_any ("Automation Runtime", "B&R", "AR_Runtime")
| extend Details = pack("DeviceName", DeviceName, "AdditionalFields", AdditionalFields);
union ProcessEvents, SystemEvents
| project Timestamp, DeviceName, ActionType, Details
| order by Timestamp desc

-- Hunt for abnormal ABB B&R Automation Runtime processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Siginfo
FROM pslist()
WHERE Name =~ "AR_Runtime" 
   OR Name =~ "AutomationRuntime"
   OR Name =~ "SDM"
   OR Exe =~ ".*B&R.*"

#!/bin/bash
# ABB B&R Automation Runtime SDM Vulnerability Remediation Script
# Checks version and provides hardening recommendations

echo "ABB B&R Automation Runtime SDM Vulnerability Remediation"
echo "========================================================"

# Function to check Automation Runtime version
check_version() {
    # Common paths for Automation Runtime
    paths=("/opt/abb/automation/runtime" "/usr/local/abb/runtime" "/var/abb/runtime")
    
    for path in "${paths[@]}"; do
        if [ -d "$path" ]; then
            version_file="$path/version.info"
            if [ -f "$version_file" ]; then
                version=$(cat "$version_file")
                echo "Found Automation Runtime version: $version"
                return 0
            fi
        fi
    done
    
    echo "Could not determine Automation Runtime version. Please check manually."
    return 1
}

# Function to check if SDM is running
check_sdm_status() {
    if pgrep -x "SDM" > /dev/null; then
        echo "System Diagnostics Manager (SDM) is running."
        return 0
    else
        echo "System Diagnostics Manager (SDM) is not running."
        return 1
    fi
}

# Function to check for vulnerable version
check_vulnerability() {
    if [ -z "$version" ]; then
        echo "Cannot check vulnerability without version information."
        return 2
    fi
    
    # Check if version is affected (simplified check for demonstration)
    # In practice, you would implement proper version comparison logic
    if [[ "$version" < "6.3" ]] || [[ "$version" < "Q4.93" ]]; then
        echo "VULNERABLE: Your Automation Runtime version ($version) is affected by the SDM DoS vulnerability."
        return 0
    else
        echo "SECURE: Your Automation Runtime version ($version) is not affected by the SDM DoS vulnerability."
        return 1
    fi
}

# Function to apply hardening measures
apply_hardening() {
    echo "Applying hardening measures..."
    
    # 1. Restrict network access to SDM
    echo "Configuring firewall to restrict access to SDM..."
    # iptables -A INPUT -p tcp --dport 4800 -s <allowed_ip_range> -j ACCEPT
    # iptables -A INPUT -p tcp --dport 4800 -j DROP
    
    # 2. Monitor for unusual SDM activity
    echo "Setting up monitoring for SDM process..."
    # Create monitoring script in /usr/local/bin/monitor_sdm.sh
    
    # 3. Enable additional logging
    echo "Enabling enhanced logging for Automation Runtime..."
    # Configure logging in Automation Runtime settings
    
    echo "Hardening measures applied."
}

# Main execution
check_version
check_sdm_status

if [ $? -eq 0 ]; then
    check_vulnerability
    if [ $? -eq 0 ]; then
        echo ""
        echo "REMEDIATION REQUIRED"
        echo "===================="
        echo "1. Update to Automation Runtime 6.3 or later"
        echo "2. Update to Automation Runtime Q4.93 or later"
        echo "3. If immediate patching is not possible, consider the following:"
        echo "   - Disable SDM if not required for operations"
        echo "   - Restrict network access to SDM ports"
        echo "   - Monitor closely for service disruptions"
        echo ""
        read -p "Apply hardening measures? (y/n) " -n 1 -r
        echo
        if [[ $REPLY =~ ^[Yy]$ ]]; then
            apply_hardening
        fi
    else
        echo "No immediate action required based on version check."
    fi
else
    echo "Could not perform complete vulnerability assessment."
fi