Critical Flaws in Belgian eID Middleware: Detection and Remediation Guide for 2 Million Exposed Users

---
title: Belgian eID Software Spawning Child Process
title: Belgian eID Software Spawning Child Process
id: 3b7f2a91-4c6d-4e58-9a21-7f0c1d5e8b34
status: experimental
description: Detects the Belgian eID Viewer or middleware processes spawning child processes, which may indicate exploitation of parsing vulnerabilities in the eID software stack.
references:
  - https://www.securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\eidviewer.exe'
      - '\beidgui.exe'
      - '\beidviewer.exe'
      - '\beidmdrv.dll'
  filter_legit:
    Image|endswith:
      - '\msiexec.exe'
  condition: selection_parent and not filter_legit
falsepositives:
  - Rare installer or updater child processes during legitimate software updates
level: high
---
title: eID Viewer Followed by Script or Shell Execution
title: eID Viewer Followed by Script or Shell Execution
id: 8c1d4e62-7a3b-49f0-b56c-2e9a1f6d7c05
status: experimental
description: Detects command shells, script interpreters, or LOLBins launched as descendants of Belgian eID software, consistent with post-exploitation after memory corruption in the eID parsing path.
references:
  - https://www.securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\eidviewer.exe'
      - '\beidgui.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - None expected in normal eID software operation
level: critical
---
title: eID Software Writing Executable Content to User-Writable Paths
title: eID Software Writing Executable Content to User-Writable Paths
id: 5f2e9b48-1d7c-4a36-8e91-4b0d6c3a9f27
status: experimental
description: Detects Belgian eID viewer or middleware processes dropping executable files to user-writable directories, a common payload-delivery behavior after successful exploitation of document parsing flaws.
references:
  - https://www.securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\eidviewer.exe'
      - '\beidgui.exe'
  selection_target:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.js'
  condition: selection_image and selection_target
falsepositives:
  - eID software self-update mechanisms writing to temporary locations (verify against signed update packages)
level: high

// Hunt: Belgian eID software spawning unexpected child processes or making network connections
let eidProcesses = dynamic(["eidviewer.exe", "beidgui.exe", "beidviewer.exe"]);
let suspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (eidProcesses)
| where FileName !in~ ("msiexec.exe", "conhost.exe")
| project ChildTime=TimeGenerated, DeviceName, DeviceId, ChildProcess=FileName,
ChildCommand=ProcessCommandLine, ChildPath=FolderPath, AccountName, InitiatingProcessFileName;
let eidNetwork = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (eidProcesses)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| project NetTime=TimeGenerated, DeviceName, DeviceId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName;
suspiciousChildren
| join kind=leftouter eidNetwork on DeviceId, $left.ChildTime >= $right.NetTime
| project ChildTime, DeviceName, ChildProcess, ChildCommand, AccountName, RemoteUrl, RemoteIP, RemotePort
| order by ChildTime desc

-- Hunt for exploitation indicators around Belgian eID software
-- Suspicious child processes of the eID viewer/middleware
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
SELECT Pid FROM pslist()
WHERE Name =~ '(?i)eidviewer|beidgui|beid'
)
AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32'

-- Secondary: executables recently written to user-writable paths on hosts with eID software installed
SELECT FullPath, Size, Mtime, Ctime
FROM glob(glob='C:/Users/*/AppData/{Local/Temp,Roaming}/**/*.exe')
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC
LIMIT 500

# Belgian eID Middleware Inventory & Remediation Verification
# Run elevated. Audit mode by default; use -Remediate to uninstall outdated versions.

param(
[switch]$Remediate
)

# Set this to the patched release from https://eid.belgium.be (verify current version at deploy time)
$MinimumSafeVersion = [version]"5.1.0"

$results = @()
$uninstallKeys = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$eidApps = Get-ItemProperty $uninstallKeys -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match 'Belgium|eID|Beid' }

if (-not $eidApps) {
Write-Host "[+] No Belgian eID software detected on this host." -ForegroundColor Green
exit 0
}

foreach ($app in $eidApps) {
$installed = $null
[void][version]::TryParse($app.DisplayVersion, [ref]$installed)
$vulnerable = ($installed -eq $null) -or ($installed -lt $MinimumSafeVersion)

$status = if ($vulnerable) { "VULNERABLE / OUTDATED" } else { "OK" }
Write-Host ("[*] {0} v{1} -> {2}" -f $app.DisplayName, $app.DisplayVersion, $status) -ForegroundColor ($vulnerable ? 'Red' : 'Green')

$results += [pscustomobject]@{
Product = $app.DisplayName
Version = $app.DisplayVersion
Vulnerable = $vulnerable
UninstallString = $app.UninstallString
}

if ($vulnerable -and $Remediate) {
Write-Host "[!] Removing outdated eID software. Install the patched release from https://eid.belgium.be afterward." -ForegroundColor Yellow
if ($app.UninstallString -match 'msiexec') {
$guid = ($app.PSChildName)
Start-Process msiexec.exe -ArgumentList "/x $guid /qn /norestart" -Wait
}
}
}

# Check for suspicious recent child-process artifacts left in eID install directory
$eidPath = "${env:ProgramFiles(x86)}\Belgium Identity Card"
if (Test-Path $eidPath) {
$recent = Get-ChildItem $eidPath -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Where-Object { -not (Get-AuthenticodeSignature $_.FullName).Status -eq 'Valid' }
if ($recent) {
Write-Host "[ALERT] Unsigned/recently modified binaries in eID directory — investigate for tampering:" -ForegroundColor Red
$recent | ForEach-Object { Write-Host " $($_.FullName)" }
}
}

$results | Export-Csv -Path ".\eid_inventory_$(hostname).csv" -NoTypeInformation

#!/bin/bash
# Belgian eID middleware version check for Debian/Ubuntu and RHEL/Fedora
# Compare installed version against the patched release from https://eid.belgium.be
MIN_SAFE="5.1.0"

if command -v dpkg >/dev/null 2>&1; then
INSTALLED=$(dpkg-query -W -f='${Version}' eid-mw 2>/dev/null)
elif command -v rpm >/dev/null 2>&1; then
INSTALLED=$(rpm -q --queryformat '%{VERSION}' eid-mw 2>/dev/null)
else
echo "[+] No supported package manager found"; exit 0
fi

if [ -z "$INSTALLED" ]; then
echo "[+] eID middleware not installed"; exit 0
fi

echo "[*] Installed eID middleware version: $INSTALLED"
if [ "$(printf '%s\n%s\n' "$MIN_SAFE" "$INSTALLED" | sort -V | head -n1)" != "$MIN_SAFE" ]; then
echo "[ALERT] Outdated eID middleware — update immediately via your package manager or https://eid.belgium.be"
exit 1
else
echo "[+] Version OK"
fi

# Flag unexpected child processes of running eID viewer (live exploitation indicator)
EID_PID=$(pgrep -f 'beidgui|eid-viewer' | head -n1)
if [ -n "$EID_PID" ]; then
CHILDREN=$(ps --ppid "$EID_PID" -o comm= 2>/dev/null)
if [ -n "$CHILDREN" ]; then
echo "[ALERT] eID viewer has child processes — possible exploitation: $CHILDREN"
fi
fi