CVE-2026-111497 (Node2Shell): Siemens Industrial Edge Management — Detection and Remediation Guide for OT Defenders

---
title: Siemens IEM Suspicious Process Spawning from Web Service Context
id: 3b8f2c41-7a1e-4d9f-b5c3-8e2f1a6d4b7c
status: experimental
description: Detects child processes spawned by web server or Node.js processes associated with Industrial Edge Management, consistent with post-exploitation activity following CVE-2026-111497 (Node2Shell) remote code execution.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\nginx.exe'
      - '\httpd.exe'
      - '\w3wp.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\nc.exe'
      - '\ncat.exe'
      - '\netcat.exe'
      - '\whoami.exe'
      - '\ipconfig.exe'
      - '\netstat.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate IEM application management scripts executed via Node.js or web service workers during planned maintenance windows
  - Siemens Industrial Edge Device Kit development activity in engineering/test environments
level: high
---
title: Siemens IEM Suspicious Network Connection from Edge Management Host
id: 9c4d7e12-3f6a-4b8d-a1e5-7c2b9f4d8e1a
status: experimental
description: Detects outbound network connections from processes running on Industrial Edge Management hosts to non-standard external destinations, potentially indicating C2 communication or data exfiltration following CVE-2026-111497 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\nginx.exe'
      - '\java.exe'
    Initiated: 'true'
  filter_siemens_update:
    DestinationHostname|endswith:
      - '.siemens.com'
      - '.siemens.de'
      - '.siemens.io'
  filter_cloud_provider:
    DestinationHostname|endswith:
      - '.amazonaws.com'
      - '.azure.com'
      - '.microsoft.com'
  condition: selection and not 1 of filter_*
falsepositives:
  - IEM telemetry and diagnostic connections to Siemens infrastructure (filter expands these as needed)
  - Legitimate third-party integrations configured by OT engineering teams
level: medium
---
title: Siemens IEM Web Shell or Suspicious File Write in Application Directories
id: 5e1a8f34-2c7d-4b9e-a3f6-1d8c5b2e7a9f
status: experimental
description: Detects file writes of executable or script content to web-accessible or application directories commonly associated with Industrial Edge Management deployments, consistent with web shell deployment following CVE-2026-111497 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\industrial-edge\'
      - '\iem\'
      - '\siemens\edge\'
      - '\wwwroot\'
      - '\nginx\html\'
      - '\node_modules\'
  selection_ext:
    TargetFilename|endswith:
      - '.js'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.sh'
      - '.py'
      - '.aspx'
      - '.php'
      - '.war'
      - '.jar'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate IEM application deployments and updates pushed through the management interface
  - Siemens IEDK application development in engineering environments
level: high

// Hunt 1: Suspicious child processes spawned by web service or Node.js processes
// Targets post-exploitation process execution on IEM hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "nginx.exe", "httpd.exe", "java.exe", "javaw.exe", "w3wp.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe",
    "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe",
    "nc.exe", "ncat.exe", "whoami.exe", "ipconfig.exe", "netstat.exe",
    "nltest.exe", "net.exe", "net1.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, AccountName, RemoteIP, RemotePort
| order by TimeGenerated desc

// Hunt 2: Outbound network connections from IEM-related processes to non-Siemens destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "nginx.exe", "java.exe")
| where ActionType == "ConnectionSuccess"
| where not(RemoteUrl has_any ("siemens.com", "siemens.de", "siemens.io",
    "amazonaws.com", "azure.com", "microsoft.com"))
| where not(RemoteIP startswith "10." or RemoteIP startswith "172.16." or RemoteIP startswith "192.168.")
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP),
    DestinationList = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where ConnectionCount > 10 or DistinctDestinations > 3
| order by TimeGenerated desc

// Hunt 3: File writes to web-accessible directories on IEM hosts (web shell staging)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("industrial-edge", "iem", "wwwroot", "nginx", "node_modules", "siemens")
| where FileName endswith_any (".js", ".exe", ".dll", ".ps1", ".bat", ".sh", ".py", ".aspx", ".php", ".war", ".jar")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType,
    InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 4: Syslog-based detection for Linux-based IEM instances (via CEF/Syslog ingestion)
Syslog
| where TimeGenerated > ago(7d)
| where Computer has_any ("iem", "industrial-edge", "edge-mgmt") or Facility == "local0"
| where SyslogMessage has_any ("brotli", "decompress", "overflow", "segfault", "SIGSEGV",
    "node", "shell", "reverse", "connect back")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

-- Security Arsenal: CVE-2026-111497 Node2Shell IEM Post-Exploitation Hunt
-- Hunt for suspicious processes, network connections, and file artifacts on IEM hosts

-- Section 1: Enumerate suspicious child processes of web service / Node.js parents
LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(cmd|powershell|pwsh|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wget|nc|ncat|whoami|ipconfig|netstat|net\.exe|net1)'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(node|nginx|httpd|java|javaw|w3wp)'
  )

-- Section 2: Network connections from IEM-related processes
LET iem_connections = SELECT Pid, Name, CommandLine, LocalAddr, LocalPort,
    RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ '(node|nginx|java)'
  AND RemotePort NOT IN (443, 80, 53, 123)
  AND RemoteAddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

-- Section 3: Recently created executable/script files in IEM directories
LET recent_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Program Files/Siemens/Industrial*/**/*.exe',
  'C:/Program Files/Siemens/Industrial*/**/*.ps1',
  'C:/Program Files/Siemens/Industrial*/**/*.bat',
  'C:/iem/**/www*/**/*.js',
  'C:/iem/**/www*/**/*.exe',
  'C:/nginx/html/**/*.exe',
  'C:/nginx/html/**/*.js',
  '/opt/siemens/**/*.sh',
  '/opt/iem/**/*.sh',
  '/var/www/**/*.py',
  '/var/www/**/*.sh'
])
WHERE Mtime > (now() - 604800)  -- Files modified in last 7 days

-- Combine results
SELECT 'SuspiciousProcess' AS ArtifactType, Pid, Name, CommandLine,
    Username, CreateTime, '' AS FullPath, '' AS RemoteAddr, '' AS RemotePort
FROM suspicious_children
UNION ALL
SELECT 'NetworkConnection' AS ArtifactType, Pid, Name, CommandLine,
    '' AS Username, '' AS CreateTime, '' AS FullPath,
    RemoteAddr, RemotePort
FROM iem_connections
UNION ALL
SELECT 'RecentFile' AS ArtifactType, '' AS Pid, '' AS Name, '' AS CommandLine,
    '' AS Username, Mtime AS CreateTime, FullPath, '' AS RemoteAddr, '' AS RemotePort
FROM recent_files

#!/bin/bash
# Security Arsenal — CVE-2026-111497 (Node2Shell) IEM Exposure Assessment Script
# Run as root or with sudo on Industrial Edge Management hosts
# Purpose: Inventory IEM deployment, assess exposure, verify patch status

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "=============================================="
echo " CVE-2026-111497 (Node2Shell) IEM Assessment"
echo " Security Arsenal — $(date '+%Y-%m-%d %H:%M:%S')"
echo "=============================================="
echo ""

# --- Section 1: Detect IEM installation ---
echo "[1] Checking for Industrial Edge Management installation..."
IEM_FOUND=false

# Check common IEM installation paths
for path in /opt/siemens /opt/iem /opt/industrial-edge /usr/local/iem /var/lib/iem; do
    if [ -d "$path" ]; then
        IEM_FOUND=true
        echo -e "  ${YELLOW}[FOUND]${NC} IEM directory: $path"
    fi
done

# Check for IEM services
for svc in iem iem-core iem-management industrial-edge edge-management; do
    if systemctl list-units --type=service --all 2>/dev/null | grep -qi "$svc"; then
        IEM_FOUND=true
        echo -e "  ${YELLOW}[FOUND]${NC} IEM service detected: $svc"
        systemctl status "$svc" --no-pager 2>/dev/null | head -5
    fi
done

# Check for IEM Docker containers (common deployment model)
if command -v docker &>/dev/null; then
    IEM_CONTAINERS=$(docker ps -a --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -iE 'iem|industrial.?edge|siemens' || true)
    if [ -n "$IEM_CONTAINERS" ]; then
        IEM_FOUND=true
        echo -e "  ${YELLOW}[FOUND]${NC} IEM Docker containers:"
        echo "$IEM_CONTAINERS" | while read -r line; do echo "    - $line"; done
    fi
fi

if [ "$IEM_FOUND" = false ]; then
    echo -e "  ${GREEN}[OK]${NC} No IEM installation detected on this host."
    echo "  This host is NOT affected by CVE-2026-111497."
    exit 0
fi

echo ""

# --- Section 2: Check for Management and Device Applications ---
echo "[2] Assessing installed Management and Device Applications..."
MGMT_APPS=false
DEVICE_APPS=false

# Check IEM API for installed apps (requires IEM CLI or API access)
if command -v iem-cli &>/dev/null; then
    echo "  Querying IEM CLI for installed applications..."
    iem-cli app list 2>/dev/null || echo "  [WARN] Could not query IEM CLI"
fi

# Check Docker for management app containers
if command -v docker &>/dev/null; then
    MGMT_LIST=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'mgmt|management|app-' || true)
    DEV_LIST=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'device|ied|app-' || true)
    [ -n "$MGMT_LIST" ] && MGMT_APPS=true && echo -e "  ${RED}[EXPOSED]${NC} Management Applications detected:"
    [ -n "$MGMT_LIST" ] && echo "$MGMT_LIST" | while read -r line; do echo "    - $line"; done
    [ -n "$DEV_LIST" ] && DEVICE_APPS=true && echo -e "  ${RED}[EXPOSED]${NC} Device Applications detected:"
    [ -n "$DEV_LIST" ] && echo "$DEV_LIST" | while read -r line; do echo "    - $line"; done
fi

if [ "$MGMT_APPS" = false ] && [ "$DEVICE_APPS" = false ]; then
    echo -e "  ${GREEN}[OK]${NC} No Management or Device Applications detected."
    echo "  Per Siemens advisory: Library present but not exposed. No immediate action required."
    echo "  RECOMMENDATION: Continue monitoring and apply patches when available."
else
    echo -e "  ${RED}[ACTION REQUIRED]${NC} This IEM instance is EXPOSED to CVE-2026-111497."
    echo "  Immediate mitigations required per Siemens advisory ICSA-26-316-03."
fi

echo ""

# --- Section 3: Check Brotli library version ---
echo "[3] Checking Brotli library version..."
# Check system Brotli
if command -v brotli &>/dev/null; then
    BROTLI_VER=$(brotli --version 2>/dev/null || echo "unknown")
    echo "  System Brotli version: $BROTLI_VER"
fi

# Check for Brotli shared libraries
find / -name 'libbrotli*' -type f 2>/dev/null | while read -r lib; do
    echo "  Found Brotli library: $lib"
    if command -v strings &>/dev/null; then
        strings "$lib" 2>/dev/null | grep -iE '^[0-9]+\.[0-9]+\.[0-9]+' | head -1 | \
            xargs -I{} echo "    Version string: {}"
    fi
done

# Check Node.js bundled Brotli
if command -v node &>/dev/null; then
    NODE_VER=$(node --version)
    echo "  Node.js version: $NODE_VER (bundles Brotli)"
fi

echo ""

# --- Section 4: Network exposure check ---
echo "[4] Checking network exposure of IEM management interfaces..."
IEM_PORTS="443 8080 8443 3000 9000 9090"
for port in $IEM_PORTS; do
    if ss -tlnp 2>/dev/null | grep -q ":${port} "; then
        PROC=$(ss -tlnp 2>/dev/null | grep ":${port} " | awk '{print $NF}' | head -1)
        echo -e "  ${YELLOW}[OPEN]${NC} Port $port is listening — $PROC"
    fi
done

echo ""

# --- Section 5: Summary and remediation guidance ---
echo "=============================================="
echo " ASSESSMENT SUMMARY"
echo "=============================================="
echo ""
if [ "$MGMT_APPS" = true ] || [ "$DEVICE_APPS" = true ]; then
    echo -e "${RED}STATUS: EXPOSED — CVE-2026-111497 mitigation required${NC}"
    echo ""
    echo "IMMEDIATE ACTIONS:"
    echo "  1. Apply Siemens mitigations per ICSA-26-316-03"
    echo "  2. Restrict network access to IEM management interfaces (firewall rules)"
    echo "  3. Deploy updated IEM version from Siemens as soon as available"
    echo "  4. Enable enhanced logging on IEM hosts and monitor for exploitation indicators"
    echo "  5. Segment IEM from OT network per IEC 62443 zone/conduit model"
    echo ""
    echo "REFERENCES:"
    echo "  - CISA Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03"
    echo "  - Siemens Security Advisory: Check Siemens ProductCERT for latest guidance"
    echo "  - Siemens Industrial Edge updates: https://support.industry.siemens.com"
else
    echo -e "${GREEN}STATUS: NOT EXPOSED (no Management/Device Apps installed)${NC}"
    echo ""
    echo "RECOMMENDED ACTIONS:"
    echo "  1. Apply IEM patches when Siemens releases them (defense-in-depth)"
    echo "  2. Maintain accurate asset inventory of all IEM/IED deployments"
    echo "  3. Monitor Siemens ProductCERT for updated guidance"
fi

echo ""
echo "Script completed at $(date '+%Y-%m-%d %H:%M:%S')"