CISA KEV Alert: Active Exploitation of PTC Windchill Unauthenticated RCE — Detection and Response

---
title: PTC Windchill Java Process Spawning Windows Shell
id: a8b9c0d1-2e3f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects the PTC Windchill Java process (typically running as tomcat or a specific PTC service) spawning cmd.exe or powershell.exe. This is a high-fidelity indicator of RCE exploitation leading to web shell activity.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  filter_legit:
    CommandLine|contains:
      - 'Veritas'
      - 'Backup'
      - 'admin_scripts'
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: Suspicious JSP/JSPX File Creation in Web Directories
id: b2c3d4e5-3f4a-5b6c-9d8e-0f1a2b3c4d5e
status: experimental
description: Detects the creation of .jsp or .jspx files, common web shell extensions for Java-based apps like Windchill, within web root directories by non-administrator processes or unusual users.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'Windchill'
      - 'ptc'
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
  filter_legit_dev:
    User|contains:
      - 'Administrator'
      - 'DevOps'
  condition: selection and not filter_legit_dev
falsepositives:
  - Legitimate PTC developers deploying updates
level: high

// Hunt for PTC Windchill exploitation: Java spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('java.exe', 'javaw.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe')
| extend ProcessCommandLine = InitiatingProcessCommandLine, ChildCommandLine = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ChildCommandLine
// Look for base64 encoded strings or suspicious arguments in child process
| where ChildCommandLine contains "-enc" or ChildCommandLine contains "DownloadString" or ChildCommandLine contains "IEX"

-- Hunt for recently modified JSP/JSPX files potentially acting as web shells
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='/*/Windchill/**/*.jsp', accessor='auto')
WHERE Mtime > now() - 7d
   OR Atime > now() - 7d

-- Hunt for suspicious Java child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'cmd.exe' OR Name =~ 'powershell.exe'
LET Parent = SELECT Pid FROM pslist() WHERE Pid = Ppid
WHERE Parent.Name =~ 'java'

<#
.SYNOPSIS
    Incident Response Script for PTC Windchill Compromise
.DESCRIPTION
    Identifies recent JSP/JSPX modifications and checks for active web shells.
    NOTE: Run as Administrator on the PTC Application Server.
#>

Write-Host "[*] Starting PTC Windchill Incident Response Check..." -ForegroundColor Cyan

# 1. Identify PTC Windchill Installation Paths (Common defaults)
$paths = @("C:\ptc", "D:\ptc", "C:\Program Files\PTC")
$webExtensions = @("*.jsp", "*.jspx")
$suspiciousStrings = @("Runtime.getRuntime().exec", "ProcessBuilder", "javax.script", "eval(", "base64decode")

# 2. Scan for recently modified JSP files (last 7 days)
Write-Host "[*] Scanning for recently modified JSP/JSPX files..." -ForegroundColor Yellow
$recentFiles = Get-ChildItem -Path $paths -Include $webExtensions -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

if ($recentFiles) {
    Write-Host "[!] Found $($recentFiles.Count) recently modified JSP/JSPX files:" -ForegroundColor Red
    $recentFiles | Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
    
    # 3. Check content for suspicious web shell signatures
    Write-Host "[*] Analyzing content for web shell signatures..." -ForegroundColor Yellow
    foreach ($file in $recentFiles) {
        $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
        if ($content) {
            foreach ($sig in $suspiciousStrings) {
                if ($content -match [regex]::Escape($sig)) {
                    Write-Host "[!!!] POTENTIAL WEB SHELL DETECTED: $($file.FullName)" -ForegroundColor Red
                    Write-Host "     Signature Match: $sig" -ForegroundColor DarkRed
                }
            }
        }
    }
} else {
    Write-Host "[+] No recently modified JSP/JSPX files found in standard paths." -ForegroundColor Green
}

Write-Host "[*] Script completed." -ForegroundColor Cyan