---
title: Schneider Electric EcoStruxure Automation Expert Vulnerable Version Detected
id: 1f5a7d8b-c4a3-4e8f-9b2d-8c7d9e6a1b5f
status: experimental
description: Detects the presence of vulnerable versions of Schneider Electric EcoStruxure Automation Expert software.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-03
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: '\EcoStruxure Automation Expert\'
  condition: selection
falsepositives:
  - Legitimate installation of patched versions
level: high
---
title: Suspicious Child Process of Schneider Electric EcoStruxure
id: 2a6b8e9c-d5b4-5f9a-0c3e-9d8e0f7b2c6g
status: experimental
description: Detects suspicious child processes spawned by Schneider Electric EcoStruxure Automation Expert which could indicate exploitation attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-03
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: '\EcoStruxure Automation Expert\'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate administrative tasks performed through the automation software
level: high
---
title: Network Connections from Schneider Electric EcoStruxure to Unusual Destinations
id: 3b7c9f0d-e6c5-6a0b-1d4f-0e9f1g8c3d7h
status: experimental
description: Detects network connections initiated by Schneider Electric EcoStruxure Automation Expert to external systems, which could indicate command and control or data exfiltration.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-03
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: '\EcoStruxure Automation Expert\'
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
falsepositives:
  - Legitimate network connections to internal industrial systems
level: medium

// Identify systems running vulnerable versions of Schneider Electric EcoStruxure Automation Expert
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName contains "EcoStruxure"
| where ProcessVersionInfoProductVersion <= "25.0.1"
| project DeviceName, ProcessVersionInfoProductVersion, ProcessVersionInfoProductName, Timestamp
| sort by Timestamp desc


// Detect suspicious process execution from Schneider Electric EcoStruxure
DeviceProcessEvents
| where ParentProcessName contains "EcoStruxure"
| where ProcessName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project DeviceName, Timestamp, AccountName, ProcessName, ParentProcessName, ProcessCommandLine
| sort by Timestamp desc


// Monitor for network anomalies from Schneider Electric systems
DeviceNetworkEvents
| where InitiatingProcessFileName contains "EcoStruxure"
| where RemoteIPType == "Public"
| project DeviceName, Timestamp, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| sort by Timestamp desc

-- Hunt for vulnerable versions of Schneider Electric EcoStruxure Automation Expert
SELECT FullPath, MTime, Size, Data.Data
FROM glob(globs='C:/Program Files/**/*EcoStruxure*.exe')
WHERE FullPath =~ 'Automation Expert'
  AND parse_string(filename=FullPath, string='(?P<version>\d+\.\d+\.\d+)') =~ '(?P<version>2[0-5]\.[0-1]\.[0-9])'


-- Detect suspicious process execution patterns from Schneider Electric software
SELECT Pid, Name, CommandLine, Exe, Parent.Pid, Parent.Name, Parent.Exe, Username, StartTime
FROM pslist()
WHERE Parent.Exe =~ 'EcoStruxure Automation Expert'
  AND Name IN ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe')

# Script to identify vulnerable versions of Schneider Electric EcoStruxure Automation Expert

$VulnerableVersions = @("25.0.1", "25.0.0", "24.0.0")
$VulnerableSystems = @()

# Get all computers in the domain
$Computers = Get-ADComputer -Filter {Enabled -eq $true} | Select-Object -ExpandProperty Name

foreach ($Computer in $Computers) {
    # Check if the computer is online
    if (Test-Connection -ComputerName $Computer -Count 1 -Quiet) {
        try {
            # Get installed software information
            $Software = Get-WmiObject -Class Win32_Product -ComputerName $Computer -ErrorAction Stop | 
                        Where-Object { $_.Name -like "*EcoStruxure*" -and $_.Name -like "*Automation Expert*" }
            
            if ($Software) {
                foreach ($App in $Software) {
                    # Check if the version is vulnerable
                    if ($VulnerableVersions -contains $App.Version) {
                        $VulnerableInfo = [PSCustomObject]@{
                            ComputerName = $Computer
                            Name = $App.Name
                            Version = $App.Version
                            InstallDate = $App.InstallDate
                        }
                        $VulnerableSystems += $VulnerableInfo
                    }
                }
            }
        }
        catch {
            Write-Host "Error connecting to $Computer`: $_" -ForegroundColor Red
        }
    }
}

# Output results
if ($VulnerableSystems.Count -gt 0) {
    Write-Host "Found $($VulnerableSystems.Count) vulnerable systems:"
    $VulnerableSystems | Format-Table -AutoSize
    # Export to CSV
    $VulnerableSystems | Export-Csv -Path "VulnerableEcoStruxureSystems.csv" -NoTypeInformation
    Write-Host "Results exported to VulnerableEcoStruxureSystems.csv"
} else {
    Write-Host "No vulnerable systems found."
}