CVE-2026-31431: Siemens SIMATIC/SIPLUS “Copy Fail” — OT Detection & Remediation Guide

---
title: Siemens AX Runtime Host Spawns Interactive Shell or Downloader
id: 8c2f6d41-7b2a-4c9e-9d31-5f6a7b8c9d0e
status: experimental
description: Detects interactive shells, script interpreters, or download tools launched on Linux hosts scoped to Siemens AX Runtime/OT runtime roles. Use asset scoping in the SIEM to avoid enterprise-wide noise.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.execution
  - attack.t1059
  - attack.command_and_control
  - attack.t1105
  - cve.2026.31431
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
  selection_parent:
    ParentImage|contains:
      - 'siemens'
      - 'simatic'
      - 'ax-runtime'
      - 'ax_runtime'
  filter_package_managers:
    Image|endswith:
      - '/apt'
      - '/apt-get'
      - '/dpkg'
  condition: selection_img and selection_parent and not filter_package_managers
falsepositives:
  - Vendor maintenance scripts executed during approved Siemens update windows
  - Container health checks that legitimately invoke sh
level: high
---
title: Persistence Artifact Created on Scoped OT Linux Runtime
id: 4d7aa0e2-6f21-4a8b-b5c3-9e1d2f3a4b5c
status: experimental
description: Detects creation or modification of common Linux persistence mechanisms on Siemens AX Runtime/CN adjacent hosts. Scope by asset tag for OT/runtime systems.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04
  - https://attack.mitre.org/techniques/T1053/003/
  - https://attack.mitre.org/techniques/T1543/002/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1543.002
  - cve.2026.31431
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/etc/cron'
      - '/var/spool/cron'
      - '/etc/systemd/system'
      - '/usr/lib/systemd/system'
      - '/etc/rc.local'
      - '/etc/sudoers'
      - '/etc/sudoers.d'
  filter_updates:
    Image|endswith:
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/rpm'
  condition: selection_paths and not filter_updates
falsepositives:
  - Approved configuration management during maintenance windows
  - Package installation creating service units
level: medium
---
title: New Local Account or Sudo Change on OT Linux Runtime
id: 1b9f4d6e-3c5a-4f77-92aa-0b1c2d3e4f60
status: experimental
description: Detects local account, SSH authorized key, or sudo privilege changes on scoped Siemens runtime hosts, useful for post-exploitation discovery after exposure to CVE-2026-31431.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1136
  - attack.privilege_escalation
  - attack.t1098
  - cve.2026.31431
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmds:
    CommandLine|contains:
      - 'useradd '
      - 'adduser '
      - 'usermod '
      - 'passwd '
      - 'authorized_keys'
      - '/etc/sudoers'
      - 'visudo'
  filter_admin_tools:
    Image|endswith:
      - '/ansible'
      - '/salt-call'
      - '/chef-client'
      - '/puppet'
  condition: selection_cmds and not filter_admin_tools
falsepositives:
  - Break-glass administration
  - Approved configuration management not present in filter
level: high

// Hunt Siemens AX Runtime/CN 4100 adjacent Linux hosts for shells, downloaders, persistence, and outbound transfer.
// Assumes OT Linux Syslog/CEF is ingested and assets are tagged as AXRuntime, CN4100, Engineering, or OT_DMZ.
let lookback = 14d;
let otAssets = dynamic(["ax-runtime","ax_runtime","simatic","siemens","cn4100","engineering","ot-dmz","ot_dmz"]);
union withsource=src
(Syslog
 | where TimeGenerated >= ago(lookback)
 | where Computer has_any (otAssets) or HostName has_any (otAssets) or Facility =~ 'auth'
 | where SyslogMessage has_any ("useradd","adduser","usermod","authorized_keys","sudoers","cron","systemd","curl ","wget ","/bin/sh","/bin/bash")
 | project TimeGenerated, Computer, ProcessName, SyslogMessage, src),
(CommonSecurityLog
 | where TimeGenerated >= ago(lookback)
 | where DeviceHostName has_any (otAssets) or SourceHostName has_any (otAssets)
 | where Message has_any ("curl","wget","bash","useradd","sudoers","authorized_keys","systemctl")
 | project TimeGenerated, DeviceHostName, SourceHostName, Message, src),
(DeviceProcessEvents
 | where TimeGenerated >= ago(lookback)
 | where DeviceName has_any (otAssets)
 | where FileName in~ ("bash","sh","dash","python","python3","curl","wget","useradd","usermod","systemctl")
    or ProcessCommandLine has_any ("authorized_keys","/etc/sudoers","curl ","wget ","/bin/sh","useradd ","usermod ")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, src)
| order by TimeGenerated desc

-- Velociraptor hunt for scoped OT Linux endpoints: volatile process, persistence, and connection evidence.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(curl |wget |/bin/(ba)?sh|useradd |usermod |authorized_keys|/etc/sudoers|systemctl (enable|link))'
   OR Exe =~ '(^|/)(bash|sh|dash|python3?|curl|wget|useradd|usermod|systemctl)$'

-- Pair with file and network context on the same endpoint:
-- SELECT FullPath, Size, Mtime FROM glob(globs=['/etc/systemd/system/*.service','/etc/cron.d/*','/etc/sudoers.d/*','/home/*/.ssh/authorized_keys','/root/.ssh/authorized_keys'])
-- SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State FROM netstat() WHERE RemoteAddr !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'

#!/usr/bin/env bash
# Siemens CVE-2026-31431 exposure audit/hardening helper for Debian-based AX Runtime hosts.
# Run read-only first; uncomment hardening section only during an approved OT maintenance window.
set -euo pipefail

OUT="/var/log/siemens_cve_2026_31431_audit_$(date +%Y%m%d_%H%M%S).log"
exec > >(tee -a "$OUT") 2>&1

echo "[+] Host: $(hostname)  Date: $(date -Is)"
echo "[+] Kernel/OS: $(uname -a)"; (cat /etc/os-release || true)

echo "[+] Listening services and owners"
(ss -lntup || netstat -lntup || true)

echo "[+] Siemens/SIMATIC package hints"
(dpkg -l 2>/dev/null | egrep -i 'siemens|simatic|ax[-_ ]runtime|cn.?4100' || true)
(rpm -qa 2>/dev/null | egrep -i 'siemens|simatic|ax[-_ ]runtime|cn.?4100' || true)

echo "[+] Container/runtime indicators"
(command -v docker >/dev/null && docker ps --format '{{.Names}} {{.Image}} {{.Ports}}' || true)
(command -v podman >/dev/null && podman ps --format '{{.Names}} {{.Image}} {{.Ports}}' || true)
(command -v crictl >/dev/null && crictl ps -o json || true)

echo "[+] Persistence quick check"
ls -l /etc/cron.d /etc/cron.daily /etc/systemd/system /usr/lib/systemd/system /etc/sudoers.d 2>/dev/null || true
find /root/.ssh /home -maxdepth 3 -name authorized_keys -printf '%p %TY-%Tm-%Td %TH:%TM:%TS %u\n' 2>/dev/null || true

echo "[+] Recent auth/process events"
(egrep -i 'useradd|adduser|usermod|sudoers|authorized_keys|curl|wget|/bin/(ba)?sh' /var/log/auth.log /var/log/secure 2>/dev/null | tail -200 || true)

echo "[+] Egress check: show non-RFC1918 established connections"
(ss -tup state established || true)

# HARDENING EXAMPLE — TEST/CHANGE-CONTROL ONLY. Restrict management to approved jump hosts.
# sudo ufw --force reset
# sudo ufw default deny incoming
# sudo ufw default allow outgoing
# sudo ufw allow from 10.10.5.0/24 to any port 22 proto tcp comment 'OT jump hosts only'
# sudo ufw allow from 10.10.6.10 to any port 443 proto tcp comment 'Vendor update repo if required'
# sudo ufw --force enable
# sudo ufw status verbose

echo "[+] Complete. Evidence log: $OUT"