Cl0p Campaign: Defending PTC Windchill & FlexPLM Against Critical Auth-Bypass RCE

---
title: PTC FlexPLM WSDL Information Disclosure Access
id: 8a4f2c1e-9d3b-45a6-b2e1-7f8c9d0a1b2c
status: experimental
description: Detects access to the FlexPLM WSDL endpoint which is targeted in the initial recon stage of Cl0p exploitation chains.
references:
  - https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web
  product: apache
  # Add nginx/iis variants as needed for your env
detection:
  selection:
    cs_uri_path|contains:
      - '/FlexPLM/'
      - '/Windchill/'
    cs_uri_path|endswith:
      - '.wsdl'
      - '?wsdl'
  condition: selection
falsepositives:
  - Legitimate developer API testing
level: medium
---
title: Java Application Server Spawning Shell - PTC Windchill
id: 9b5g3d2f-0e4c-56d7-a8f9-2e3d4c5b6a7d
status: experimental
description: Detects the PTC Windchill Java process spawning cmd.exe or powershell.exe, a strong indicator of successful RCE.
references:
  - https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'windchill'
      - 'ptc'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Administrative troubleshooting (rare on production app servers)
level: critical

// Hunt for PTC WSDL access and anomalies
let WSDLAccess = DeviceNetworkEvents
| where UrlOriginal contains "FlexPLM" or UrlOriginal contains "Windchill"
| where UrlOriginal contains "wsdl"
| project TimeGenerated, DeviceName, SourceIP, UrlOriginal, RemotePort;
// Join with Process Creation to detect web shell activity or RCE follow-up
let ProcessSpawns = DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe"
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "bash")
| project TimeGenerated, DeviceName, ProcessFileName, InitiatingProcessCommandLine;
WSDLAccess
| join kind=inner ProcessSpawns on DeviceName
| where ProcessSpawns_TimeGenerated between (WSDLAccess_TimeGenerated - 5min .. WSDLAccess_TimeGenerated + 5min)
| project TimeGenerated, DeviceName, SourceIP, UrlOriginal, ProcessFileName, CommandLine=InitiatingProcessCommandLine

-- Hunt for suspicious Java processes and network activity
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'java'
  AND (CommandLine =~ 'windchill' OR CommandLine =~ 'FlexPLM')
  AND Pid IN (
      -- Check if this Java process spawned a shell
      SELECT ParentPid
      FROM pslist()
      WHERE Name =~ 'sh' OR Name =~ 'bash' OR Name =~ 'cmd.exe' OR Name =~ 'powershell.exe'
  )

# PTC Windchill/FlexPLM Exposure Assessment Script
# Run as Administrator on the application server

Write-Host "[+] Checking for PTC Windchill and FlexPLM Services..." -ForegroundColor Cyan

$ptcServices = Get-WmiObject Win32_Service | Where-Object { 
    $_.Name -like "*Windchill*" -or 
    $_.Name -like "*FlexPLM*" -or 
    $_.PathName -like "*Windchill*" -or 
    $_.PathName -like "*FlexPLM*" 
}

if ($ptcServices) {
    foreach ($svc in $ptcServices) {
        Write-Host "[!] Found PTC Service: $($svc.Name)" -ForegroundColor Yellow
        Write-Host "    State: $($svc.State)"
        Write-Host "    Path: $($svc.PathName)"
        
        # Check for associated Java processes
        $processId = (Get-WmiObject Win32_Process | Where-Object { $_.CommandLine -like "*$($svc.Name)*" }).ProcessId
        if ($processId) {
            Write-Host "    Running PID: $processId"
        }
    }
} else {
    Write-Host "[-] No PTC services found via WMI." -ForegroundColor Gray
}

# Check for listening ports associated with PTC (Default 80/443, often 8080)
Write-Host "\n[+] Checking for suspicious listening ports (Web Interfaces)..." -ForegroundColor Cyan

$netstat = netstat -ano | Select-String "LISTENING"
$targetPorts = @(80, 443, 8080, 8443)

foreach ($port in $targetPorts) {
    $listeners = $netstat | Select-String ":$port "
    if ($listeners) {
        Write-Host "[!] Port $port is listening. Verify if this is the PTC interface." -ForegroundColor Yellow
        $listeners | ForEach-Object {
            $parts = $_ -split '\s+'
            $pid = $parts[-1]
            $proc = Get-Process -Id $pid -ErrorAction SilentlyContinue
            Write-Host "    PID: $pid ($($proc.ProcessName))"
        }
    }
}

Write-Host "\n[+] Recommendation: If PTC services are found, ensure they are NOT internet-exposed." -ForegroundColor Green
Write-Host "    Apply the latest security patches from PTC Support immediately."