CVE-2026-110936: Siemens Software Center DLL Sideloading Exploited in ClickFix RAT Campaigns — Detection and Remediation Guide

---
title: ClickFix-Style Execution via Run Dialog - Suspicious Child of Explorer
id: 3f8a2c91-7d4e-4b1a-9c6f-2e5d8a1b4f09
status: experimental
description: Detects ClickFix social engineering pattern where a user is tricked into pasting a malicious command into the Windows Run dialog, resulting in script interpreters or download cradles spawned directly by explorer.exe with suspicious command lines.
references:
  - https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\cmd.exe'
  selection_cl:
    CommandLine|contains:
      - ' -enc'
      - ' -e '
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'hidden'
      - 'bypass'
      - 'mshta http'
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_image and selection_cl
falsepositives:
  - Rare legitimate administrative use of Run dialog with encoded commands
level: high
---
title: DLL Dropped in Siemens Software Center Directory by Non-Installer Process
id: 9c1e5b47-2a8d-4f36-b7e1-5d3a9c6f8210
status: experimental
description: Detects creation of DLL files in Siemens Software Center installation or search-path directories by processes other than legitimate installers/updaters, consistent with CVE-2026-110936 DLL staging for sideloading.
references:
  - https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
  - https://attack.mitre.org/techniques/T1574/001/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Siemens\SoftwareCenter\'
      - '\Siemens\Automation\'
      - '\Program Files\Siemens\'
      - '\Program Files (x86)\Siemens\'
  selection_ext:
    TargetFilename|endswith: '.dll'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\Siemens.SoftwareCenter.exe'
      - '\TrustedInstaller.exe'
      - '\TiWorker.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Legitimate Siemens software deployments using non-standard installer names - baseline installer names in your environment
level: high
---
title: Siemens Software Center Loading DLL from User-Writable Path
id: 5b7d3e92-4f1a-4c68-a2d9-8e6b1f3a7c45
status: experimental
description: Detects Siemens Software Center or related Siemens processes loading DLLs from user-writable locations such as Downloads, Temp, AppData, or Public folders - a hallmark of DLL sideloading exploitation of CVE-2026-110936.
references:
  - https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_process:
    Image|contains: '\Siemens\'
  selection_dll_path:
    ImageLoaded|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\Public\'
      - '\ProgramData\'
  condition: selection_process and selection_dll_path
falsepositives:
  - Developer or test builds of Siemens components - verify signature status of loaded DLL
level: critical

// Hunt: ClickFix initial execution correlated with Siemens DLL staging (CVE-2026-110936)
let Lookback = 7d;
let ClickFixExec = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "curl.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-enc", "iex", "Invoke-Expression", "Invoke-WebRequest", "iwr ", "hidden", "bypass", "http://", "https://")
| project ClickFixTime = Timestamp, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let SiemensDllWrites = DeviceFileEvents
| where Timestamp > ago(Lookback)
| where ActionType == "FileCreated"
| where FileName endswith ".dll"
| where FolderPath has_any ("\\Siemens\\SoftwareCenter\\", "\\Program Files\\Siemens\\", "\\Program Files (x86)\\Siemens\\", "\\Siemens\\Automation\\")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe", "TrustedInstaller.exe", "TiWorker.exe")
| project DllWriteTime = Timestamp, DeviceId, DeviceName, FolderPath, FileName, SHA256, DllWriterProcess = InitiatingProcessFileName, DllWriterCmd = InitiatingProcessCommandLine;
ClickFixExec
| join kind=inner SiemensDllWrites on DeviceId
| where DllWriteTime between (ClickFixTime .. ClickFixTime + 2h)
| project ClickFixTime, DllWriteTime, DeviceName, AccountName, ProcessCommandLine, FolderPath, FileName, SHA256, DllWriterProcess, DllWriterCmd
| sort by ClickFixTime desc;

// Hunt A: Siemens processes loading DLLs from user-writable paths (sideload behavior)
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has "\\Siemens\\" or FolderPath has "\\Siemens\\"
| where FolderPath has_any ("\\Users\\", "\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\Public\\")
| where FileName endswith ".dll"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FolderPath, FileName, SHA256
| sort by Timestamp desc;

// Hunt B: Any file writes into Siemens install dirs by non-installer processes
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "\\Siemens\\"
| where FileName endswith ".dll"
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe", "TrustedInstaller.exe", "TiWorker.exe", "System")
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Devices = dcount(DeviceId)
  by InitiatingProcessFileName, InitiatingProcessFolderPath, FileName
| sort by Devices asc;

-- CVE-2026-110936 Hunt: Suspicious DLLs in Siemens paths + ClickFix execution evidence
-- Part 1: Inventory DLLs in Siemens Software Center directories with signature status
LET dll_inventory = SELECT
    FullPath,
    Mtime AS Modified,
    Size,
    hash(path=FullPath).MD5 AS MD5,
    authenticode(filename=FullPath).Status AS SignatureStatus,
    authenticode(filename=FullPath).Subject AS Signer
FROM glob(globs=[
    'C:/Program Files/Siemens/**/*.dll',
    'C:/Program Files (x86)/Siemens/**/*.dll',
    'C:/Program Files/Siemens/SoftwareCenter/*.dll'
])
WHERE SignatureStatus != 'trusted'
   OR Signer !~ 'Siemens'

-- Part 2: Recent ClickFix-pattern process execution (script interpreter child of explorer)
LET clickfix_procs = SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ '(?i)powershell|pwsh|mshta|wscript|cscript|curl'
  AND CommandLine =~ '(?i)(-enc|iex|invoke-expression|invoke-webrequest|hidden|bypass|http)'

SELECT * FROM dll_inventory
UNION ALL
SELECT * FROM clickfix_procs

# CVE-2026-110936 Assessment Script - Security Arsenal
# Verifies Siemens Software Center state and hunts for sideloaded DLLs / ClickFix artifacts

$report = [ordered]@{}

# 1. Locate Siemens Software Center installations
$siemensPaths = @(
    "$env:ProgramFiles\Siemens",
    "${env:ProgramFiles(x86)}\Siemens"
) | Where-Object { Test-Path $_ }

$report['SiemensInstalled'] = ($siemensPaths.Count -gt 0)
Write-Host "[+] Siemens directories found: $($siemensPaths -join '; ')"

# 2. Enumerate installed Siemens software and versions (verify against patched baseline)
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $_.DisplayName -match 'Siemens' } |
             Select-Object DisplayName, DisplayVersion, InstallDate
$installed | Format-Table -AutoSize
Write-Host "[!] ACTION: Compare DisplayVersion values against the fixed versions in the Siemens ProductCERT advisory for CVE-2026-110936."

# 3. Scan for unsigned / non-Siemens DLLs in Siemens installation directories
$suspiciousDlls = foreach ($path in $siemensPaths) {
    Get-ChildItem -Path $path -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'Siemens') {
            [PSCustomObject]@{
                Path       = $_.FullName
                LastWrite  = $_.LastWriteTime
                SigStatus  = $sig.Status
                Signer     = $sig.SignerCertificate.Subject
            }
        }
    }
}

if ($suspiciousDlls) {
    Write-Host "[-] SUSPICIOUS: Unsigned or non-Siemens-signed DLLs found (potential sideload staging):" -ForegroundColor Red
    $suspiciousDlls | Format-Table -AutoSize
    $report['SuspiciousDllCount'] = $suspiciousDlls.Count
} else {
    Write-Host "[+] No unsigned DLLs detected in Siemens directories."
    $report['SuspiciousDllCount'] = 0
}

# 4. Check for DLLs in user-writable paths referencing Siemens (dropper staging)
$userWritableHits = Get-ChildItem "$env:USERPROFILE\Downloads", "$env:TEMP", "$env:LOCALAPPDATA\Temp" -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, LastWriteTime
if ($userWritableHits) {
    Write-Host "[!] Recent DLLs in user-writable paths - review for staging activity:" -ForegroundColor Yellow
    $userWritableHits | Format-Table -AutoSize
}

# 5. Review recent Run dialog history (MRU) for ClickFix-style pasted commands
$runMru = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue
if ($runMru) {
    $runMru.PSObject.Properties | Where-Object { $_.Name -match '^[a-z]$' } |
    ForEach-Object {
        if ($_.Value -match '(?i)powershell|mshta|curl|iex|-enc|http') {
            Write-Host "[-] CLICKFIX INDICATOR in Run dialog history: $($_.Value)" -ForegroundColor Red
        }
    }
}

Write-Host "`n[+] Assessment complete. Escalate any RED findings to IR immediately."