Critical WAGO Switch CLI Escape: Patching Guide for CVE-2026-3587

---
title: Suspicious Outbound SSH Connection to OT Network
id: 8c4f2a1b-9d3e-4f5a-8b2c-1d3e4f5a6b7c
status: experimental
description: Detects outbound SSH or Telnet connections from non-standard administrative workstations to internal network segments, potentially indicating access to OT devices like WAGO switches.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-01
author: Security Arsenal
date: 2026/03/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 22
      - 23
    Initiated: 'true'
  filter:
    Image|endswith:
      - '\putty.exe'
      - '\ssh.exe'
      - '\plink.exe'
      - '\telnet.exe'
    User|contains:
      - 'admin'
      - 'service'
      - 'svc_'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative access by engineers using non-standard tools
level: medium
---
title: Industrial Switch Management Tool Execution
id: a2b3c4d5-e6f7-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of common industrial management tools (WAGO specific or generic) which may be used to exploit CLI interfaces.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/03/01
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WAGO-Software.exe'
      - '\CodeSys.exe'
      - '\ethernet-config.exe'
    CommandLine|contains:
      - 'cli'
      - 'script'
      - 'enable'
  condition: selection
falsepositives:
  - Legitimate configuration changes by OT personnel
level: low

// Detect successful logons to WAGO devices or similar OT assets
// Note: Requires authentication logs or firewall logs forwarded to Sentinel
DeviceNetworkEvents
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted")
| where RemotePort in (22, 23, 102, 502) 
| where InitiatingProcessFileName !in ("putty.exe", "ssh.exe", "telnet.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| summarize count() by DeviceName, RemoteIP, InitiatingProcessAccountName


// Hunt for processes interacting with potential industrial IP ranges
// Update the IP range CIDR to match your OT environment
let OTRange = "10.20.30.0/24"; 
DeviceProcessEvents 
| where InitiatingProcessFileName in~ ("putty.exe", "plink.exe", "ssh.exe", "telnet.exe", "powershell.exe")
| where IPV4 matches regex @"\b10\.(" + OTRange + ")" // Simplified regex for demo, normally precise CIDR match logic is used
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

-- Hunt for active SSH/Telnet connections to non-standard ports
SELECT Pid, ProcessName, CommandLine, RemoteAddress, RemotePort, State
FROM process_listing(pid=plist())
WHERE Name =~ 'ssh' OR Name =~ 'telnet' OR Name =~ 'putty'

-- Search for SSH history or known config files that might contain WAGO IPs
SELECT FullPath, Mtime, Size, Data
FROM glob(globs='C:\Users\*\ssh\config', globs='C:\Users\*\.ssh\known_hosts')
WHERE Data =~ '10.' OR Data =~ '192.168.'  

<#
.SYNOPSIS
    Scans a subnet for open SSH/Telnet ports to identify WAGO devices.
.DESCRIPTION
    This script attempts to connect to common WAGO management ports to identify hosts that require patching.
    Note: Update the $Subnet variable to match your industrial network range.
#>

$Subnet = "192.168.1"
$Ports = @(22, 23, 80, 443)
$FoundDevices = @()

1..254 | ForEach-Object {
    $IP = "$Subnet.$_"
    Write-Host "Scanning $IP..." -NoNewline
    
    foreach ($Port in $Ports) {
        try {
            $TcpClient = New-Object System.Net.Sockets.TcpClient
            $Connect = $TcpClient.BeginConnect($IP, $Port, $null, $null)
            $Wait = $Connect.AsyncWaitHandle.WaitOne(100, $false)
            
            if ($Wait) {
                Write-Host " [Open Port $Port]" -ForegroundColor Cyan
                $FoundDevices += [PSCustomObject]@{
                    IPAddress = $IP
                    Port     = $Port
                    Status   = "Open"
                }
                $TcpClient.Close()
            } else {
                $TcpClient.Close()
            }
        } catch {
            # Ignore connection errors
        }
    }
}

if ($FoundDevices) {
    Write-Host "\nPotential devices found requiring verification:" -ForegroundColor Yellow
    $FoundDevices | Format-Table -AutoSize
} else {
    Write-Host "No devices found on specified range." -ForegroundColor Green
}