CVE-2026-110936: Siemens Software Center DLL Hijacking — Detection and Remediation Guide for ICS Environments

---
title: DLL Planted in User-Writable Directory for Search Path Hijacking
id: 3f8a1c42-7b2d-4e19-a6d5-9c0e2f4b7a18
status: experimental
description: Detects creation of DLL files in user-writable directories commonly abused for DLL search order hijacking against applications with uncontrolled search paths, such as Siemens Software Center (CVE-2026-110936).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
  - https://attack.mitre.org/techniques/T1574/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith: '.dll'
  filter_legit_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
  condition: selection_paths and selection_ext and not filter_legit_installers
falsepositives:
  - Legitimate application installers and updaters writing DLLs to ProgramData
  - Developer build tooling
level: medium
---
title: Siemens Software Center Process Spawning Suspicious Child Process
id: 8c2e5d91-4f6a-4b38-9e1c-2d7a9f3b6e05
status: experimental
description: Detects Siemens Software Center processes spawning command shells, script interpreters, or LOLBins, consistent with arbitrary code execution following DLL hijacking (CVE-2026-110936).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1574.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Siemens\'
    ParentImage|endswith:
      - '.exe'
  selection_parent_swc:
    ParentImage|contains:
      - 'SoftwareCenter'
      - 'Software Center'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: (selection_parent or selection_parent_swc) and selection_child
falsepositives:
  - Rare: Siemens update routines invoking system utilities — validate against change windows
level: high
---
title: Unsigned or Non-Standard Path DLL Loaded by Siemens Process
id: 5d1b9f73-2a8c-4e67-b3d4-6f0c8a2e9b41
status: experimental
description: Detects DLL image loads by Siemens Software Center binaries from user-writable or non-standard directories, indicative of DLL search order hijacking (CVE-2026-110936).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
  - https://attack.mitre.org/techniques/T1574/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\Siemens\'
      - 'SoftwareCenter'
  selection_dllpath:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\Temp\'
      - '\Downloads\'
      - '\ProgramData\'
  filter_known:
    ImageLoaded|contains:
      - '\AppData\Local\Microsoft\'
  condition: selection_image and selection_dllpath and not filter_known
falsepositives:
  - Legitimate Siemens plugins installed to ProgramData — baseline and whitelist per host
level: high

// Hunt 1: Siemens Software Center processes spawning shells/LOLBins (post-hijack execution)
let SiemensProc = dynamic(["SoftwareCenter", "\\Siemens\\"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFolderPath has_any (SiemensProc)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFolderPath, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

// Hunt 2: DLLs created in user-writable directories on hosts with Siemens installed
let WritablePaths = dynamic(["\\AppData\\Local\\Temp\\","\\AppData\\Roaming\\","\\Downloads\\","\\Users\\Public\\","\\ProgramData\\"]);
Event
| where TimeGenerated > ago(14d)
| where EventLog == "Microsoft-Windows-Sysmon/Operational"
| where EventID == 11
| extend EvData = parse_xml(EventData)
| extend TargetFile = tostring(EvData.EventData.Data.[7].["#text"])
| extend Creator = tostring(EvData.EventData.Data.[4].["#text"])
| where TargetFile endswith ".dll"
| where TargetFile has_any (WritablePaths)
| where Creator !has "msiexec"
| project TimeGenerated, Computer, Creator, TargetFile
| order by TimeGenerated desc;

// Hunt 3: Baseline — enumerate all Siemens Software Center installs and versions via process launch paths
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FolderPath has "SoftwareCenter" or FolderPath has "\\Siemens\\"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), LaunchCount=count()
  by DeviceName, FolderPath, FileName, ProcessVersionInfoProductVersion
| order by DeviceName asc;

-- Hunt: DLLs planted in user-writable directories (CVE-2026-110936 staging)
-- plus running Siemens processes for triage

LET planted_dlls = SELECT
    FullPath,
    Size,
    Mtime AS Modified,
    Btime AS Created
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Temp/**/*.dll',
    'C:/Users/*/AppData/Roaming/**/*.dll',
    'C:/Users/*/Downloads/**/*.dll',
    'C:/Users/Public/**/*.dll',
    'C:/ProgramData/**/*.dll'
])
WHERE Modified > now() - 60*60*24*30  -- last 30 days

SELECT * FROM planted_dlls
ORDER BY Modified DESC;

-- Companion: enumerate running Siemens Software Center processes
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ 'Siemens' OR Exe =~ 'SoftwareCenter';

# CVE-2026-110936 - Siemens Software Center verification and hardening audit
# Run elevated on each engineering workstation / HMI

$fixedVersion = [version]"4.0.9.8"
$report = [System.Collections.Generic.List[object]]::new()

# --- 1. Locate installed version via registry uninstall keys ---
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$swc = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
       Where-Object { $_.DisplayName -match 'Siemens Software Center' }

if ($swc) {
    foreach ($app in $swc) {
        $ver = $null
        [void][version]::TryParse($app.DisplayVersion, [ref]$ver)
        $status = if ($ver -and $ver -lt $fixedVersion) { 'VULNERABLE - update to 4.0.9.8+' } else { 'Patched/Unknown' }
        $report.Add([pscustomobject]@{
            Check   = 'Installed Version'
            Detail  = "$($app.DisplayName) $($app.DisplayVersion)"
            Status  = $status
        })
    }
} else {
    $report.Add([pscustomobject]@{ Check='Installed Version'; Detail='Siemens Software Center not found via registry'; Status='Verify manually if Siemens products present' })
}

# --- 2. Audit install directory ACLs for non-admin write access ---
$installGuess = @('C:\Program Files\Siemens', 'C:\Program Files (x86)\Siemens')
foreach ($dir in $installGuess) {
    if (Test-Path $dir) {
        $acl = Get-Acl $dir
        $weak = $acl.Access | Where-Object {
            $_.FileSystemRights -match 'Write|Modify|FullControl' -and
            $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
            $_.AccessControlType -eq 'Allow'
        }
        if ($weak) {
            $report.Add([pscustomobject]@{ Check='Directory ACL'; Detail="$dir writable by: $($weak.IdentityReference -join ', ')"; Status='RISK - restrict ACLs' })
        } else {
            $report.Add([pscustomobject]@{ Check='Directory ACL'; Detail="$dir"; Status='OK' })
        }
    }
}

# --- 3. Audit system PATH for user-writable directories (search path abuse) ---
$pathDirs = [Environment]::GetEnvironmentVariable('Path','Machine') -split ';'
foreach ($p in $pathDirs) {
    if ($p -and (Test-Path $p -ErrorAction SilentlyContinue)) {
        $a = Get-Acl $p -ErrorAction SilentlyContinue
        $w = $a.Access | Where-Object {
            $_.FileSystemRights -match 'Write|Modify|FullControl' -and
            $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
            $_.AccessControlType -eq 'Allow'
        }
        if ($w) {
            $report.Add([pscustomobject]@{ Check='PATH Directory'; Detail="$p writable by standard users"; Status='RISK - enables DLL search path abuse' })
        }
    }
}

# --- 4. Sweep for recently created DLLs in writable staging dirs ---
$stageDirs = @("$env:TEMP","$env:APPDATA","$env:USERPROFILE\Downloads",'C:\Users\Public')
foreach ($sd in $stageDirs) {
    Get-ChildItem $sd -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object {
            $report.Add([pscustomobject]@{ Check='Staged DLL'; Detail="$($_.FullName) (modified $($_.LastWriteTime))"; Status='INVESTIGATE' })
        }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\CVE-2026-110936-Audit-$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "`nAudit complete. Any 'VULNERABLE', 'RISK', or 'INVESTIGATE' rows require action." -ForegroundColor Yellow