CVE-2026-16675: Rockwell FactoryTalk Activation Manager SYSTEM Installer Consoles — Detection and Remediation Guide

---
title: Windows Installer Spawns Shell During FactoryTalk Activation Manager Install or Repair
id: 8f2f6b6a-7c5e-4f4a-9a26-cve202616675
status: experimental
description: Detects cmd, conhost, PowerShell, wscript, or cscript spawned by msiexec or setup while FactoryTalk/Activation install or repair indicators are present. Intended to catch SYSTEM console exposure described in ICSA-26-244-04.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1548/002/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\install.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\conhost.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_context:
    CommandLine|contains:
      - 'FactoryTalk'
      - 'Activation Manager'
      - 'REINSTALL'
      - '/repair'
      - '/fa'
      - 'msiexec'
  condition: selection_parent and selection_child and selection_context
falsepositives:
  - Legitimate Rockwell installation or repair performed by authorized change window; validate against CMDB ticket and installer hash
level: high
---
title: SYSTEM Interactive Console Created On FactoryTalk Host
id: 4b1a7d55-2b3d-4c74-8c5d-ftamconsole26
status: experimental
description: Looks for interactive console/shell processes on hosts with FactoryTalk installation paths where the command line references activation, licensing, or repair. Use on engineering workstations, HMIs, and OT jump hosts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\conhost.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_markers:
    CommandLine|contains:
      - 'FactoryTalk Activation Manager'
      - 'FactoryTalk Activation'
      - 'FTActivation'
      - 'Activation Manager'
      - 'Rockwell Automation'
      - 'repair'
  filter_common:
    CommandLine|contains:
      - 'conhost.exe 0xffffffff'
  condition: selection_shell and selection_markers and not filter_common
falsepositives:
  - Vendor support sessions and approved licensing maintenance; scope to critical assets and require change record
level: medium
---
title: FactoryTalk Activation Manager Install Directory Modified Outside Approved Setup
id: 0a6d2b2f-c24a-4e42-a43c-ftamfile26
status: experimental
description: Detects creation of scripts or executables in FactoryTalk Activation Manager directories by processes other than known installer binaries. Useful for post-escalation persistence and tamper hunting.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
  - https://attack.mitre.org/techniques/T1036/
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Rockwell Automation\FactoryTalk Activation Manager\'
      - '\Rockwell Software\FactoryTalk Activation\'
      - '\ProgramData\Rockwell Automation\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
      - '.js'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Rare vendor updates deployed by non-MSI tooling; allowlist by signed Rockwell binary and approved deployment ring
level: high

// Hunt for installer-spawned shells and SYSTEM-context process creation on FactoryTalk assets.
// Scope Hosts first where possible: engineering workstations, HMI servers, OT jump hosts, license servers.
let ftAssets =
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has_any ('FactoryTalk Activation Manager','FactoryTalk Activation','Rockwell Automation')
| summarize by DeviceName;
DeviceProcessEvents
| where Timestamp > ago(14d)
| where DeviceName in (ftAssets)
| where FileName in~ ('cmd.exe','conhost.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe')
   or InitiatingProcessFileName in~ ('msiexec.exe','setup.exe','install.exe')
| where ProcessCommandLine has_any ('FactoryTalk','Activation Manager','REINSTALL','/repair','/fa','Rockwell Automation')
   or InitiatingProcessCommandLine has_any ('FactoryTalk','Activation Manager','REINSTALL','/repair','/fa','Rockwell Automation')
| extend SystemInvolved = (AccountSid == 'S-1-5-18' or InitiatingProcessAccountSid == 'S-1-5-18' or AccountName =~ 'SYSTEM' or InitiatingProcessAccountName =~ 'SYSTEM')
| project Timestamp, DeviceName, AccountName, AccountSid, SystemInvolved, FileName, ProcessCommandLine, ProcessIntegrityLevel,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountSid,
          FolderPath, SHA256, ReportId
| order by Timestamp desc

// Correlate with Windows Installer service events in Sentinel/Defender where MSI logging is present.
let InstallerEvents =
SecurityEvent
| where TimeGenerated > ago(14d)
| where ProviderName =~ 'MsiInstaller'
| summarize by Computer, EventID, TimeGenerated, Message;
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ 'msiexec.exe'
| where ProcessCommandLine has_any ('FactoryTalk','Activation','repair','REINSTALL','/fa')
| join kind=leftouter (InstallerEvents) on $left.DeviceName == $right.Computer
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine, EventID, Message
| order by Timestamp desc

-- Velociraptor hunt: SYSTEM shells/consoles and installer lineage around FactoryTalk Activation Manager.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
   CommandLine =~ 'FactoryTalk|Activation Manager|Rockwell Automation|REINSTALL|/repair|/fa'
   OR Exe =~ 'Rockwell Automation|FactoryTalk'
)
AND (
   Name =~ 'cmd|conhost|powershell|pwsh|wscript|cscript|msiexec|setup'
   OR Username =~ 'SYSTEM'
)
ORDER BY CreateTime DESC

-- Follow-on artifact: list likely install directories and recently modified executable/script content.
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs='C:/Program Files*/Rockwell*/**/*')
WHERE Mtime > now() - (14 * 24 * 3600)
  AND FullPath =~ '\.(exe|dll|bat|cmd|ps1|vbs|js)$'

# Audit-and-harden helper for CVE-2026-16675 exposure. Run elevated on candidate Windows hosts.
# It reports vulnerable installs, checks ACL drift, finds recent installer shell lineage, and exports JSON evidence.
$ErrorActionPreference = 'SilentlyContinue'
$out = Join-Path $env:TEMP 'ftam_cve_2026_16675_audit.json'
$fixedKnown = $false  # Set to $true only after Rockwell CSAF identifies the fixed build for your exact product line.

$installed = Get-CimInstance Win32_Product | Where-Object { $_.Name -match 'FactoryTalk Activation Manager' } |
  Select-Object Name, Version, Vendor, IdentifyingNumber, InstallLocation

$registryInstalled = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match 'FactoryTalk Activation Manager' } |
  Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation, PSChildName

$candidateRoots = @(
  (Join-Path ${env:ProgramFiles} 'Rockwell Automation'),
  (Join-Path ${env:ProgramFiles(x86)} 'Rockwell Automation'),
  (Join-Path $env:ProgramData 'Rockwell Automation')
) | Where-Object { $_ -and (Test-Path $_) }

$aclFindings = foreach ($root in $candidateRoots) {
  Get-ChildItem $root -Recurse -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -match 'FactoryTalk Activation|Activation Manager' } |
    ForEach-Object {
      $acl = Get-Acl $_.FullName
      $weak = $acl.Access | Where-Object {
        $_.IdentityReference -match 'BUILTIN\Users|Everyone|DOMAIN\Domain Users' -and
        $_.FileSystemRights -match 'Write|Modify|FullControl' -and
        $_.AccessControlType -eq 'Allow'
      }
      if ($weak) { [pscustomobject]@{ Path=$_.FullName; WeakPrincipal=($weak.IdentityReference -join ';'); Rights=($weak.FileSystemRights -join ';') } }
    }
}

$recentInstallerShells = Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14) } |
  Where-Object { $_.Message -match 'msiexec.exe|setup.exe' -and $_.Message -match 'cmd.exe|conhost.exe|powershell.exe|wscript.exe|cscript.exe' -and $_.Message -match 'FactoryTalk|Activation Manager|REINSTALL|/repair|/fa' } |
  Select-Object TimeCreated, Id, Message

$result = [pscustomobject]@{
  Host = $env:COMPUTERNAME
  CheckedUtc = (Get-Date).ToUniversalTime()
  FixedVersionKnownToScript = $fixedKnown
  InstalledFromWmi = $installed
  InstalledFromRegistry = $registryInstalled
  PotentiallyVulnerable = ($registryInstalled | Where-Object { [version]$_.DisplayVersion -le [version]'5.02' }).Count -gt 0
  WeakAclFindings = $aclFindings
  RecentInstallerShellEvents = $recentInstallerShells
  RecommendedAction = 'If PotentiallyVulnerable is true: isolate from non-admin local logon, block install/repair until approved, retrieve Rockwell CSAF fixed build, then update and reboot under change control.'
}
$result | ConvertTo-Json -Depth 6 | Set-Content -Path $out -Encoding UTF8
$result
Write-Output ('Evidence written to ' + $out)

# Optional containment for approved emergency windows only: remove broad write/modify rights after validating app function.
# Do not run in production without application owner signoff and a rollback snapshot.
# foreach ($f in $aclFindings) { icacls $f.Path /remove:g 'BUILTIN\Users' 'Everyone' }