CISA ICSA-26-300-02: Mitsubishi Electric GENESIS64 / ICONICS Suite Vulnerabilities — ICS Detection, Hardening, and Patching Guide

---
title: ICONICS GENESIS64 Component Spawning Shell or Scripting Engine
id: 3f8a1c94-7b2e-4d51-9a6c-8e0f2b1d5a37
status: experimental
description: Detects cmd, PowerShell, wscript, cscript, mshta, or rundll32 spawned as a child of any process running from ICONICS/GENESIS64/MC Works64 installation paths. Strong indicator of post-exploitation command execution through a compromised HMI/SCADA service or web component.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Program Files\ICONICS\'
      - '\Program Files\Mitsubishi Electric\'
      - '\Program Files (x86)\ICONICS\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Integrator maintenance scripts during scheduled service windows — baseline and allowlist by parent process name and service account
level: high
---
title: IIS Worker Process Serving MobileHMI Spawning Suspicious Child Process
id: 9c2e5b17-4a8d-4f63-b7e1-2d9a4c6e8f05
status: experimental
description: Detects w3wp.exe (IIS worker process) spawning command shells, scripting engines, or download cradles on hosts running MobileHMI or other ICONICS web components. Pre-authentication web vulnerabilities in HMI platforms typically manifest as w3wp spawning cmd or PowerShell.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare on dedicated SCADA web servers; any hit on an HMI host warrants triage
level: critical
---
title: Network Exposure of GenBroker SCADA Communications Port
id: 5d1f7a38-2c6b-4e94-a3d9-7f0b8c2e4a61
status: experimental
description: Detects inbound network connections to the ICONICS GenBroker default port (TCP 38000) from sources outside the defined OT/SCADA segment. GenBroker should only be reachable from known HMI clients and engineering stations; IT-side or internet-sourced connections indicate reconnaissance or exploitation attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
  - https://attack.mitre.org/techniques/T0846/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.discovery
  - attack.t0846
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 38000
    Initiated: 'true'
  filter_ot_segment:
    SourceIp|startswith:
      - '10.20.'
      - '192.168.10.'
  condition: selection and not filter_ot_segment
falsepositives:
  - Legitimate cross-segment HMI clients if OT addressing differs — replace filter prefixes with your actual SCADA VLAN ranges before deploying
level: high

// Hunt: post-exploitation behaviors on GENESIS64 / ICONICS / MobileHMI hosts
let HMIServers = dynamic(["HMI-SRV-01","GENESIS64-WEB","MCWORKS64-01"]); // replace with your inventory or a Sentinel watchlist
let Lookback = 14d;
let SuspiciousChildren = dynamic([@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\wscript.exe",@"\cscript.exe",@"\mshta.exe",@"\rundll32.exe",@"\certutil.exe",@"\bitsadmin.exe"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName in~ (HMIServers)
    | where (InitiatingProcessFolderPath has_any (@"\ICONICS\", @"\Mitsubishi Electric\")
             or InitiatingProcessFileName =~ "w3wp.exe")
    | where FileName has_any (SuspiciousChildren)
    | project TimeGenerated, DeviceName, AccountName,
              ParentProcess=InitiatingProcessFileName,
              ParentCmd=InitiatingProcessCommandLine,
              ChildProcess=FileName, ChildCmd=ProcessCommandLine, SHA256
    | extend Hunt="SuspiciousChildProcess"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName in~ (HMIServers)
    | where LocalPort == 38000 and ActionType == "InboundConnectionAccepted"
    | summarize Connections=count(), Sources=make_set(RemoteIP, 20) by DeviceName, bin(TimeGenerated, 1h)
    | extend Hunt="GenBrokerInbound"),
    (SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | where Computer in~ (HMIServers)
    | project TimeGenerated, Computer, ServiceName=EventData.ServiceName,
              ServiceBinary=EventData.ImagePath, InstalledBy=EventData.SubjectUserName
    | extend Hunt="NewServiceInstalled")
| order by TimeGenerated desc

-- Artifact: ICONICS_GENESIS64_Triage
-- Purpose: Triage a GENESIS64/ICONICS/MC Works64 host for compromise indicators
SELECT * FROM chain(
-- 1. Running processes from ICONICS/Mitsubishi install paths and their children
a={
  SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Exe =~ '(?i)ICONICS|Mitsubishi Electric'
     OR CommandLine =~ '(?i)ICONICS|GENESIS64|MCWorks64|FrameWorX|GenBroker'
},
-- 2. Listening ports — flag GenBroker (38000), web ports, and unexpected listeners
b={
  SELECT Pid, Name, Path, LocalAddress.IP AS LocalIP,
         LocalAddress.Port AS LocalPort, Status
  FROM netstat()
  WHERE Status =~ 'LISTEN'
    AND (LocalAddress.Port in (38000, 80, 443, 8080, 8880)
         OR Path =~ '(?i)ICONICS|Mitsubishi')
},
-- 3. Services installed from suspicious or non-standard paths
s={
  SELECT Name, DisplayName, PathName, StartName, State
  FROM services()
  WHERE PathName =~ '(?i)ICONICS|Mitsubishi|Temp|AppData|ProgramData\\.{1}[^\\]{1,8}\\.exe'
})

# GENESIS64 / ICONICS exposure & version inventory - read-only assessment
# Run elevated. Output: CSV artifacts for patching scope and exposure review.

$out = "$env:TEMP\iconics_audit_$(Get-Date -Format yyyyMMdd)"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. Installed ICONICS / Mitsubishi Electric products and versions
$products = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
            "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'ICONICS|GENESIS|Hyper Historian|AnalytiX|MobileHMI|IoTWorX|MC Works|BizViz' } |
  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
$products | Export-Csv "$out\installed_products.csv" -NoTypeInformation
$products | Format-Table -AutoSize

# 2. Listening exposure: GenBroker 38000 and common MobileHMI web ports
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
  Where-Object { $_.LocalPort -in 38000,80,443,8080,8880 } |
  Select-Object LocalAddress, LocalPort,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
$listeners | Export-Csv "$out\listeners.csv" -NoTypeInformation
$listeners | Format-Table -AutoSize

# 3. IIS sites (MobileHMI) - check for internet-facing bindings
if (Get-Module -ListAvailable -Name WebAdministration) {
  Import-Module WebAdministration
  Get-Website | Select-Object Name, State,
    @{n='Bindings';e={($_.Bindings.Collection | ForEach-Object {$_.bindingInformation}) -join '; '}} |
    Export-Csv "$out\iis_sites.csv" -NoTypeInformation
}

# 4. ICONICS/GENESIS-related services and their logon accounts (flag service acct risk)
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match 'ICONICS|Mitsubishi' -or $_.DisplayName -match 'ICONICS|GENESIS|FrameWorX|GenBroker' } |
  Select-Object Name, DisplayName, State, StartMode, StartName, PathName |
  Export-Csv "$out\services.csv" -NoTypeInformation

# 5. EDR/AV presence check - HMI servers are frequently blind spots
$av = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue |
  Select-Object displayName, productState
$av | Export-Csv "$out\av_edr.csv" -NoTypeInformation
if (-not $av) { Write-Warning "No AV/EDR registered in SecurityCenter2 - this host is a monitoring blind spot." }

# 6. Quick persistence sweep: Run keys + recently created services (last 30 days)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -ErrorAction SilentlyContinue |
  Out-File "$out\run_keys.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Export-Csv "$out\new_services_30d.csv" -NoTypeInformation

Write-Host "`nAudit complete. Review artifacts in $out" -ForegroundColor Green
Write-Host "Next: compare installed_products.csv versions against ICSA-26-300-02 fixed-version list." -ForegroundColor Yellow