---
title: Suspicious Process Spawn by EcoStruxure PME or EPO
id: 9b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects the execution of command shells (cmd.exe or powershell.exe) spawned by Schneider Electric EcoStruxure PME or EPO processes, which may indicate exploitation or suspicious activity.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-04
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - 'Schneider Electric'
      - 'EcoStruxure'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Legitimate administrative maintenance tasks performed by engineers
level: high
---
title: Potential Persistence via Registry by EcoStruxure Process
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects registry modifications for persistence keys made by Schneider Electric binaries, potentially indicating a compromised service account establishing persistence.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_add
  product: windows
detection:
  selection:
    Image|contains:
      - 'Schneider Electric'
      - 'EcoStruxure'
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
  condition: selection
falsepositives:
  - Legitimate software updates or configuration changes
level: medium

// Detect suspicious command shells spawned by EcoStruxure applications
DeviceProcessEvents  
| where InitiatingProcessFolderPath contains @'Schneider Electric' or InitiatingProcessFolderPath contains @'EcoStruxure'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessFolderPath

// Hunt for unsigned or suspicious binaries in the EcoStruxure directory
DeviceFileEvents
| where FolderPath contains @'Schneider Electric' 
| where SHA256 !in ('') // Filter for files with hashes available
| join kind=leftouter (DeviceFileCertificateInfo) on SHA256
| where isnull(CertificateIssuer) or IsCertificateValid == false
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, CertificateIssuer, IsSigned

-- Hunt for suspicious child processes of EcoStruxure applications
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Exe AS ParentExe
FROM pslist()
WHERE Parent.Name =~ 'EcoStruxure' 
   OR Parent.Exe =~ 'Schneider Electric'
   AND Name IN ('cmd.exe', 'powershell.exe', 'bash')

-- Identify installed EcoStruxure PME/EPO versions for patch verification
SELECT FullPath, Mtime, Size, Version
FROM glob(globs='C:\Program Files (x86)\Schneider Electric\**\*.exe')
WHERE FullPath =~ 'EcoStruxure'

<#
.SYNOPSIS
    Checks installed Schneider Electric EcoStruxure versions against a safe baseline.
.DESCRIPTION
    This script queries the registry and file system to find installed EcoStruxure PME/EPO versions 
    and compares them to a patched version.
#>

$TargetSafeVersion = "2024.0.0" # UPDATE THIS WITH THE PATCHED VERSION FROM THE ADVISORY
$InstallPaths = @(
    "${env:ProgramFiles(x86)}\Schneider Electric\EcoStruxure Power Monitoring Expert",
    "${env:ProgramFiles(x86)}\Schneider Electric\EcoStruxure Power Operation"
)

foreach ($Path in $InstallPaths) {
    if (Test-Path $Path) {
        Write-Host "Checking path: $Path" -ForegroundColor Cyan
        $ExeFiles = Get-ChildItem -Path $Path -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue
        
        foreach ($File in $ExeFiles) {
            try {
                $VersionInfo = $File.VersionInfo
                if ($VersionInfo.FileVersion) {
                    $CurrentVersion = [System.Version]::Parse($VersionInfo.FileVersion)
                    $SafeVersion = [System.Version]::Parse($TargetSafeVersion)
                    
                    if ($CurrentVersion -lt $SafeVersion) {
                        Write-Host "[VULNERABLE] $($File.FullName) - Version: $($VersionInfo.FileVersion)" -ForegroundColor Red
                    } else {
                        Write-Host "[PATCHED] $($File.FullName) - Version: $($VersionInfo.FileVersion)" -ForegroundColor Green
                    }
                }
            } catch {
                # Ignore files without valid version info
            }
        }
    } else {
        Write-Host "Path not found: $Path" -ForegroundColor Gray
    }
}