CISA Alert: ABB Automation Builder Gateway Remote Exposure – Detection and Hardening Guide

---
title: ABB Automation Builder Gateway Process Execution
id: 9a3b2c1d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Identifies the execution of the ABB Automation Builder Gateway process (AbaGate.exe). This helps identify assets hosting the vulnerable service.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.discovery
  - attack.t1595.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\AbaGate.exe'
  condition: selection
falsepositives:
  - Authorized installation and operation of ABB Automation Builder
level: low
---
title: Remote Network Connection to ABB Gateway Port
id: 8f2a1b9c-4d5e-4f6a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects inbound network connections to the default ABB Automation Builder Gateway port (2400/TCP) from non-private IP ranges, indicating potential unauthorized access attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 2400
    Initiated: 'false'
  filter_internal:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate remote administration from trusted external partners (VPN)
level: high

// Hunt for external connections to ABB Automation Builder Gateway (Port 2400)
DeviceNetworkEvents
| where RemotePort == 2400
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionEstablished"
| extend IsPrivate = ipv4_is_private(RemoteIP)
| where IsPrivate == false
| project Timestamp, DeviceName, InitiatingProcessAccount, RemoteIP, RemotePort, LocalPort, ActionType
| order by Timestamp desc

-- Hunt for ABB Gateway processes and open listeners on Port 2400
SELECT Pid, Name, Exe, Cmdline
FROM pslist()
WHERE Name =~ "AbaGate"

SELECT Pid, Family, Address, Port, State
FROM netstat()
WHERE Port = 2400 AND State = "LISTENING"

# ABB Automation Builder Gateway Remediation/Hardening Script

Write-Host "[+] Checking ABB Automation Builder Installation..." -ForegroundColor Cyan

# Check for uninstall registry entry to determine version
$regPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$app = Get-ItemProperty $regPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*Automation Builder*" -and $_.Publisher -like "*ABB*" }

if ($app) {
    Write-Host "[+] Found Installation: $($app.DisplayName)" -ForegroundColor Green
    Write-Host "    Installed Version: $($app.DisplayVersion)"

    # Check against vulnerable versions (< 2.9.0)
    try {
        [version]$installedVersion = $app.DisplayVersion
        [version]$safeVersion = "2.9.1" # Patched version target
        [version]$vulnerableThreshold = "2.9.0"

        if ($installedVersion -le $vulnerableThreshold) {
            Write-Host "[!] WARNING: Vulnerable version detected ($installedVersion)." -ForegroundColor Red
            Write-Host "    Action Required: Update to version > 2.9.0 immediately."
        } else {
            Write-Host "[+] Version appears patched (> 2.9.0)." -ForegroundColor Green
        }
    } catch {
        Write-Host "[!] Could not parse version number." -ForegroundColor Yellow
    }
} else {
    Write-Host "[-] ABB Automation Builder not found in registry." -ForegroundColor Yellow
}

Write-Host "`
[+] Checking for listeners on default ABB Gateway Port (2400)..." -ForegroundColor Cyan

$listeners = Get-NetTCPConnection -LocalPort 2400 -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Listen" }

if ($listeners) {
    Write-Host "[!] Port 2400 is currently LISTENING." -ForegroundColor Yellow
    Write-Host "    Action Required: Ensure Windows Firewall restricts inbound TCP 2400 to trusted engineering subnets only."
    $listeners | Select-Object LocalAddress, LocalPort, State, OwningProcess | Format-Table -AutoSize
} else {
    Write-Host "[+] Port 2400 is not listening." -ForegroundColor Green
}

Write-Host "[!] IMPORTANT: Verify that PLC User Management is ENABLED and default passwords are not in use." -ForegroundColor Cyan