---
title: Potential ICS Network Scanning Targeting Common SICAM Ports
id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential network scanning or denial of service attempts targeting Siemens SICAM devices by monitoring high-frequency connection attempts to commonly used ICS ports.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-01
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.reconnaissance
  - attack.t1046
  - attack.impact
  - attack.t1498
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|startswith: 
      - 102
      - 2404
      - 502
      - 8080
    Initiated: 'true'
  condition: selection
falsepositives:
  - Legitimate engineering workstation traffic
  - Scheduled polling from SCADA headends
level: medium
---
title: Suspicious Execution of Siemens SICAM Management Tools
id: b8c9d0e1-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects the execution of Siemens SICAM configuration or management binaries on endpoints that are not authorized engineering workstations.
references:
  - https://cert-portal.siemens.com/productcert/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\SICAM'
      - '\SICORE'
      - '\RTUM'
  filter:
    ParentImage|contains: 
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection and not filter
falsepositives:
  - Authorized maintenance by engineers
  - Automated deployment scripts
level: low

// Hunt for failed connection attempts to SICAM devices (Potential DoS)
let SICAMPorts = dynamic([102, 2404, 502, 8080]);
DeviceNetworkEvents
| where RemotePort in SICAMPorts
| where ActionType == "ConnectionFailed" or NetworkConnectionDirection == "Outbound"
| summarize count() by DeviceName, RemoteIP, RemotePort, bin(Timestamp, 5m)
| where count_ > 50
| project Timestamp, DeviceName, RemoteIP, RemotePort, count_


// Identify devices running Siemens SICAM software (Based on installed software inventory)
DeviceProcessEvents
| where FileName has "SICAM" 
   or ProcessVersionInfoInternalFileName has "SICAM"
| distinct DeviceName, FileName, ProcessVersionInfoProductVersion,FolderPath
| project DeviceName, SoftwareName=FileName, Version=ProcessVersionInfoProductVersion, Path=FolderPath

-- Hunt for Siemens SICAM related executables on Windows endpoints
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:\Program Files\**\*SICAM*.exe')

-- Hunt for configuration files associated with CPCI85 or SICORE
SELECT FullPath, Size, Mtime
FROM glob(globs='C:\**\*.sic')
WHERE FullPath =~ '(?i)sicam'

<#
.SYNOPSIS
    Checks for installed Siemens SICAM components.
.DESCRIPTION
    Queries the registry and file system for known Siemens SICAM software paths to identify assets requiring patch review.
#>

$PathsToCheck = @(
    "C:\Program Files\Siemens\",
    "C:\Program Files (x86)\Siemens\",
    "D:\Siemens\"
)

$FoundSoftware = @()

foreach ($Path in $PathsToCheck) {
    if (Test-Path $Path) {
        Write-Host "Checking path: $Path" -ForegroundColor Cyan
        $Items = Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue -Filter "*SICAM*.exe"
        foreach ($Item in $Items) {
            $VersionInfo = $Item.VersionInfo
            $Details = [PSCustomObject]@{
                Name       = $Item.Name
                Path       = $Item.FullName
                Version    = $VersionInfo.FileVersion
                Modified   = $Item.LastWriteTime
            }
            $FoundSoftware += $Details
        }
    }
}

if ($FoundSoftware.Count -gt 0) {
    Write-Host "Potential SICAM components found:" -ForegroundColor Yellow
    $FoundSoftware | Format-Table -AutoSize
} else {
    Write-Host "No SICAM software found in standard paths." -ForegroundColor Green
}