CVE-2026-27875: Johnson Controls Simplex Incident Manager Credential Exposure — Detection and Remediation Guide

---
title: Suspicious Memory Access to Simplex Incident Manager Process
id: 8f2c1d4a-3b6e-4a9f-b7c2-5e8d1a0f3c94
status: experimental
description: Detects processes opening handles with memory-read access rights to Johnson Controls Simplex Incident Manager processes, consistent with CVE-2026-27875 credential extraction from cleartext process memory.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/08/21
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|contains:
      - '\\Simplex'
      - '\\IncidentManager'
      - 'IncidentManager.exe'
      - 'SimplexIM.exe'
  selection_access:
    GrantedAccess|contains:
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1FFFFF'
      - '0x1010'
  filter_legit:
    SourceImage|contains:
      - 'C:\\Windows\\System32\\'
      - 'C:\\Program Files\\Johnson Controls\\'
      - 'C:\\Program Files (x86)\\Johnson Controls\\'
  condition: selection_target and selection_access and not filter_legit
falsepositives:
  - Vendor maintenance tools and legitimate Johnson Controls service utilities
  - Antivirus/EDR memory scanning engines (tune by SourceImage hash)
level: high
---
title: Process Dump Tool Execution on Incident Management Host
id: 2d7e9b31-6a4c-4f18-9d55-8c3a1e6b0f27
status: experimental
description: Detects execution of known process-dumping utilities and comsvcs.dll MiniDump abuse on hosts, a common method to extract cleartext credentials such as those exposed by CVE-2026-27875.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/08/21
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection_procdump:
    CommandLine|contains:
      - 'procdump'
      - ' -ma '
      - ' -mm '
  selection_comsvcs:
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
  selection_sqldumper:
    Image|endswith:
      - '\\sqldumper.exe'
      - '\\createdump.exe'
      - '\\dumpit.exe'
      - '\\nanodump.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate crash-dump collection by support engineers during vendor troubleshooting
  - Automated application error reporting (WER) — tune by parent process
level: high
---
title: LSASS Memory Access by Non-System Process on OT Workstation
id: 4a1b8c65-9d20-4e73-b381-6f0c2a7d5e19
status: experimental
description: Detects non-standard processes accessing LSASS memory. Relevant as follow-on behavior after credential theft via CVE-2026-27875 on hosts bridging building automation and IT networks.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/08/21
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1FFFFF'
  filter_system:
    SourceImage|startswith:
      - 'C:\\Windows\\System32\\'
      - 'C:\\ProgramData\\Microsoft\\Windows Defender\\'
  condition: selection and not filter_system
falsepositives:
  - EDR/AV credential-theft protection modules (allowlist by signed binary hash)
  - Legitimate identity management agents
level: critical

let Lookback = 14d;
let DumpTools = dynamic(["procdump", "comsvcs.dll", "MiniDump", "sqldumper", "createdump", "nanodump", "dumpit"]);
union
(DeviceProcessEvents
 | where TimeGenerated > ago(Lookback)
 | where ProcessCommandLine has_any (DumpTools)
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256),
(DeviceEvents
 | where TimeGenerated > ago(Lookback)
 | where ActionType == "OpenProcessApiCall"
 | where AdditionalFields has "lsass" or AdditionalFields has_any ("Simplex", "IncidentManager")
 | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields),
(SecurityEvent
 | where TimeGenerated > ago(Lookback)
 | where EventID == 4656 or EventID == 4663
 | where ObjectName has_any ("lsass", "IncidentManager", "Simplex")
 | project TimeGenerated, Computer, SubjectUserName, ProcessName, ObjectName, AccessMask),
(CommonSecurityLog
 | where TimeGenerated > ago(Lookback)
 | where Message has_any (DumpTools) or Message has_any ("IncidentManager", "Simplex") and Message has "GrantedAccess"
 | project TimeGenerated, Computer, SourceUserName, Message)
| order by TimeGenerated desc

-- Hunt for credential-dumping tooling and suspicious processes on Simplex Incident Manager hosts
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(procdump|comsvcs\.dll|MiniDump|sqldumper|createdump|nanodump|dumpit|\-ma )'
   OR Exe =~ '(?i)(procdump|sqldumper|nanodump|createdump|dumpit)'
   OR (Name =~ '(?i)(incidentmanager|simplex)')

-- Search for recently created memory dump files that may contain extracted credentials
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/*.dmp', 'C:/Windows/Temp/*.dmp', 'C:/ProgramData/**/*.dmp', 'C:/*.dmp'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

# CVE-2026-27875 - Simplex Incident Manager Host Hardening & Verification
# Run elevated on each host running Simplex Incident Manager

$Report = @()

# 1. Identify Simplex Incident Manager installation and version
$installPaths = @(
    "$env:ProgramFiles\Johnson Controls",
    "${env:ProgramFiles(x86)}\Johnson Controls",
    "$env:ProgramFiles\Simplex",
    "${env:ProgramFiles(x86)}\Simplex"
)
foreach ($path in $installPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include *.exe -ErrorAction SilentlyContinue |
            Where-Object { $_.Name -match 'Incident|Simplex|IM' } |
            ForEach-Object {
                $Report += [PSCustomObject]@{
                    Check   = 'InstallInventory'
                    Detail  = "$($_.FullName) - Version $($_.VersionInfo.ProductVersion)"
                    Status  = if ($_.VersionInfo.ProductVersion -match '^(1\.|2\.0|2\.01)') { 'VULNERABLE - <= V2.01' } else { 'Review version against vendor advisory' }
                }
            }
    }
}

# 2. Check LSA Protection (RunAsPPL) - blocks non-trusted memory reads of LSASS
$ppl = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
$Report += [PSCustomObject]@{
    Check  = 'LSA Protection (RunAsPPL)'
    Detail = "RunAsPPL = $ppl"
    Status = if ($ppl -eq 1) { 'PASS' } else { 'FAIL - Set HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1' }
}

# 3. Check Credential Guard
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{
    Check  = 'Credential Guard'
    Detail = "SecurityServicesRunning: $($cg.SecurityServicesRunning -join ',')"
    Status = if ($cg.SecurityServicesRunning -contains 1) { 'PASS' } else { 'WARN - Enable Credential Guard via GPO/Intune' }
}

# 4. Ensure plaintext credential caching (WDigest UseLogonCredential) is disabled
$wdigest = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name UseLogonCredential -ErrorAction SilentlyContinue).UseLogonCredential
$Report += [PSCustomObject]@{
    Check  = 'WDigest plaintext caching'
    Detail = "UseLogonCredential = $wdigest"
    Status = if ($wdigest -eq 0) { 'PASS' } else { 'FAIL - Set UseLogonCredential = 0' }
}

# 5. Sweep for suspicious dump artifacts (last 14 days)
$dumpPaths = @("$env:TEMP", 'C:\Windows\Temp', 'C:\ProgramData', 'C:\')
$susDumps = foreach ($p in $dumpPaths) {
    Get-ChildItem -Path $p -Filter *.dmp -Recurse -ErrorAction SilentlyContinue -Depth 2 |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
}
$Report += [PSCustomObject]@{
    Check  = 'Recent dump artifacts'
    Detail = if ($susDumps) { ($susDumps.FullName -join '; ') } else { 'None found' }
    Status = if ($susDumps) { 'INVESTIGATE - possible credential extraction' } else { 'PASS' }
}

# 6. Verify restricted local logon - list local admins for least-privilege review
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{
    Check  = 'Local Administrators'
    Detail = ($admins.Name -join '; ')
    Status = 'REVIEW - remove any account not operationally required'
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "C:\CVE-2026-27875-HostAudit-$(hostname)-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "`nAudit exported. Remediate FAIL/INVESTIGATE items and upgrade Simplex Incident Manager past V2.01 per the Johnson Controls advisory." -ForegroundColor Yellow