CVE-2026-13348: Schneider Electric PowerChute Serial Shutdown Brute-Force Gap — Detection and Remediation

---
title: PowerChute Serial Shutdown Spawning Command Shell or Script Interpreter
id: 9c7a4d12-8f3b-4c1e-a2d5-6e7f8a9b0c1d
status: experimental
description: Detects PowerChute Serial Shutdown processes launching shells, script interpreters, or system utilities that could indicate post-authentication abuse or unauthorized operational commands.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-07
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\PowerChute'
      - '\Schneider Electric'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\net.exe'
      - '\shutdown.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor update or maintenance activity during approved change windows
  - Legitimate UPS shutdown scripts explicitly launched by the product
level: high
---
title: Unauthorized Modification of PowerChute Serial Shutdown Installation Files
id: 4f6e2a81-7c0d-4b9e-9a31-2d3c4b5a6f70
status: experimental
description: Detects creation or modification of files in PowerChute Serial Shutdown installation paths by processes other than expected installers or updaters.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-07
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.persistence
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\PowerChute'
      - '\Schneider Electric\PowerChute'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\installer.exe'
    CommandLine|contains:
      - 'install'
      - 'update'
      - 'patch'
  condition: selection_path and not filter_installers
falsepositives:
  - Authorized Schneider Electric upgrades
  - Configuration management or backup agents touching application directories
level: medium

// Identify hosts with PowerChute Serial Shutdown telemetry, then look for suspicious child processes.
let lookback = 7d;
let pcs_hosts = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName has_any ("powerchute", "pcss") or ProcessCommandLine has "PowerChute" or FolderPath has "PowerChute"
| summarize by DeviceId;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| join kind=inner pcs_hosts on DeviceId
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "net.exe", "shutdown.exe")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), SampleCommand=any(ProcessCommandLine)
  by DeviceName, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by LastSeen desc;

// Hunt authentication failure bursts involving likely UPS/PowerChute hosts ingested via Syslog/CEF.
let lookback = 7d;
Syslog
| where TimeGenerated >= ago(lookback)
| where Computer has_any ("ups", "powerchute", "pcss") or ProcessName has_any ("powerchute", "pcss") or SyslogMessage has "PowerChute"
| where SyslogMessage has_any ("Failed password", "authentication failure", "Invalid user", "failed login", "Login failed")
| summarize FailedAttempts=count(), Users=dcount(UserName), SourceIPs=make_set(HostIP, 10), Sample=any(SyslogMessage)
  by Computer, Facility, SeverityLevel, bin(TimeGenerated, 5m)
| where FailedAttempts >= 10 or Users >= 5
| order by FailedAttempts desc;

// Windows hosts: failed logon bursts on servers that appear to run PowerChute.
let lookback = 7d;
let pcs_windows_hosts = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has "PowerChute" or FolderPath has "PowerChute"
| summarize by DeviceName;
SecurityEvent
| where TimeGenerated >= ago(lookback)
| where Computer in (pcs_windows_hosts)
| where Activity has "4625" or EventID == 4625
| summarize FailedLogons=count(), Accounts=dcount(TargetUserName), Sources=dcount(IpAddress), SampleSource=any(IpAddress)
  by Computer, bin(TimeGenerated, 5m)
| where FailedLogons >= 10 or Accounts >= 5 or Sources >= 3
| order by FailedLogons desc;

-- Velociraptor hunt: find PowerChute Serial Shutdown processes and command lines that reference shutdown or UPS management.
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Name =~ '(?i)(powerchute|pcss|ups)'
   OR Exe =~ '(?i)(Schneider Electric|PowerChute)'
   OR CommandLine =~ '(?i)(powerchute|pcss|graceful shutdown|ups shutdown)'

# Security Arsenal - CVE-2026-13348 inventory, exposure check, and hardening verification
# Run elevated on Windows servers/workstations that may host Schneider Electric PowerChute Serial Shutdown.

$fixedVersionHint = "Confirm the fixed build in the Schneider Electric CSAF linked from CISA ICSA-26-260-07"
$uninstallRoots = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$installs = foreach ($root in $uninstallRoots) {
  Get-ItemProperty $root -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match "PowerChute Serial Shutdown|PowerChute" } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation, UninstallString
}

$report = foreach ($app in $installs) {
  $parsed = $null
  $isAffected = $null
  if ([version]::TryParse(($app.DisplayVersion -replace '[^0-9\.]', ''), [ref]$parsed)) {
    $isAffected = ($parsed -le [version]'1.5') -or ($parsed -eq [version]'1.6')
  }
  [pscustomobject]@{
    DisplayName      = $app.DisplayName
    DisplayVersion   = $app.DisplayVersion
    ParsedVersion    = $parsed
    AffectedPerCISA  = $isAffected
    Publisher        = $app.Publisher
    InstallLocation  = $app.InstallLocation
    Action           = if ($isAffected -eq $true) { "UPGRADE/ISOLATE NOW" } elseif ($isAffected -eq $false) { "Verify against vendor fixed release" } else { "Manual version validation required" }
    FixedVersionHint = $fixedVersionHint
  }
}

$services = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match "powerchute|pcss|ups" -or $_.DisplayName -match "PowerChute|UPS" -or $_.PathName -match "PowerChute|Schneider Electric" } |
  Select-Object Name, DisplayName, State, StartMode, StartName, PathName, ProcessId

$processes = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match "powerchute|pcss|ups" -or $_.ExecutablePath -match "PowerChute|Schneider Electric" -or $_.CommandLine -match "PowerChute|shutdown" } |
  Select-Object ProcessId, Name, ExecutablePath, CommandLine, ParentProcessId

$pids = @($processes.ProcessId + $services.ProcessId | Where-Object { $_ } | Select-Object -Unique)
$listeners = if ($pids.Count -gt 0) {
  Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $pids -contains $_.OwningProcess } |
    Select-Object LocalAddress, LocalPort, OwningProcess, State
}

[pscustomobject]@{
  ComputerName = $env:COMPUTERNAME
  CheckedAt    = (Get-Date).ToUniversalTime().ToString("o")
  Installs     = @($report)
  Services     = @($services)
  Processes    = @($processes)
  Listeners    = @($listeners)
  Advisory     = "https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-07"
  NextSteps    = @(
    "Apply the Schneider Electric fixed release from the CSAF for CVE-2026-13348.",
    "Restrict PowerChute management listeners to approved jump-host subnets only.",
    "Block internet exposure and validate no public IP maps to the host or interface.",
    "Centralize application, OS authentication, firewall, and shutdown-event logs.",
    "Alert on repeated authentication failures and any PowerChute-spawned shell/process."
  )
} | ConvertTo-Json -Depth 6