CVE-2026-34223: Siemens Desigo CC Client Code Execution — Detection and Remediation Guide for Building Automation Operators

---
title: Desigo CC Client Process Spawning Script Interpreter or Shell
id: 3f9c1a72-8b4d-4e6f-9a21-c7e5d3b8f012
status: experimental
description: Detects Siemens Desigo CC client application processes spawning command shells or script interpreters, consistent with exploitation of CVE-2026-34223 via crafted graphics documents with embedded scripts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Siemens\Desigo'
      - '\Desigo CC\'
    ParentImage|endswith:
      - '\desigocc.exe'
      - '\desigoccclient.exe'
      - '\smc.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\msbuild.exe'
      - '\csc.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Desigo CC maintenance scripts launched via vendor tooling (verify with Siemens documentation and change records)
level: high
---
title: Executable or Script Dropped into Desigo CC Graphics or Project Directories
id: 8d2e4b61-1f7a-4c93-b5e8-9f6a2d4c7e31
status: experimental
description: Detects creation of executable or script files within Desigo CC installation, project, or graphics directories, which may indicate delivery of a crafted graphics document or post-exploitation staging related to CVE-2026-34223.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Desigo CC\'
      - '\Siemens\Desigo\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.js'
      - '.hta'
  condition: selection_path and selection_ext
falsepositives:
  - Siemens software updates and hotfix installation (correlate with maintenance windows and signed installer activity)
level: medium
---
title: Desigo CC Client Process Making Unusual Network Connections
id: 5c7f2e94-3a8b-4d12-9f67-1b8e6c3a9d45
status: experimental
description: Detects Desigo CC client processes establishing outbound network connections to non-OT, non-corporate destinations, potentially indicating command-and-control activity following CVE-2026-34223 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\Desigo CC\'
      - '\Siemens\Desigo\'
    DestinationPort:
      - 80
      - 443
      - 8080
      - 4444
  filter_private:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  condition: selection and not filter_private
falsepositives:
  - Siemens license validation or cloud telemetry endpoints (whitelist known Siemens infrastructure)
level: medium

let ScriptEngines = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","wmic.exe","msbuild.exe","bitsadmin.exe"]);
let DesigoParents = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFolderPath has_any ("Desigo", "Siemens")
| summarize by InitiatingProcessFileName;
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Desigo CC", "Siemens\\Desigo")
   or InitiatingProcessFileName in~ (DesigoParents)
| extend ChildIsScriptEngine = FileName in~ (ScriptEngines)
| project TimeGenerated, DeviceName, AccountName,
          ParentProcess = InitiatingProcessFileName,
          ParentPath = InitiatingProcessFolderPath,
          ChildProcess = FileName, ChildCommandLine = ProcessCommandLine,
          ChildIsScriptEngine, SHA256, ReportId
| order by ChildIsScriptEngine desc, TimeGenerated desc

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Desigo CC", "Siemens\\Desigo")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172."
| summarize ConnectionCount = count(), Ports = make_set(RemotePort), RemoteIPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName, RemoteUrl
| where ConnectionCount > 3
| order by ConnectionCount desc

-- Hunt for suspicious child processes spawned by Desigo CC client processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Exe =~ '(?i)desigo|siemens'
)

-- Inventory recently created executables and scripts in Desigo CC directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/Siemens/**/*.exe',
  'C:/Program Files (x86)/Siemens/**/*.exe',
  'C:/Program Files/Siemens/**/*.ps1',
  'C:/Program Files/Siemens/**/*.js',
  'C:/Program Files/Siemens/**/*.vbs',
  'C:/Program Files/Siemens/**/*.bat'
])
WHERE Mtime > now() - 60*60*24*14
ORDER BY Mtime DESC

# CVE-2026-34223 - Desigo CC inventory, version check, and hardening audit
# Run elevated on operator workstations and engineering stations

Write-Host "=== Desigo CC Installation Inventory ===" -ForegroundColor Cyan
$paths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Desigo' } |
    Select-Object DisplayName, DisplayVersion, InstallDate, Publisher |
    Format-Table -AutoSize

Write-Host "=== Desigo CC Running Processes ===" -ForegroundColor Cyan
Get-Process | Where-Object { $_.Path -match 'Desigo|Siemens' } |
    Select-Object Name, Id, Path | Format-Table -AutoSize

Write-Host "=== Child Process Audit (last 24h, if Sysmon installed) ===" -ForegroundColor Cyan
if (Get-WinEvent -ListLog 'Microsoft-Windows-Sysmon/Operational' -ErrorAction SilentlyContinue) {
    Get-WinEvent -FilterHashtable @{
        LogName = 'Microsoft-Windows-Sysmon/Operational'
        Id = 1
        StartTime = (Get-Date).AddDays(-1)
    } -ErrorAction SilentlyContinue | Where-Object {
        $_.Message -match '(?i)ParentImage.*(desigo|siemens)' -and
        $_.Message -match '(?i)Image.*(cmd\.exe|powershell|wscript|cscript|mshta|rundll32)'
    } | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "Sysmon not installed. Deploy Sysmon with process-creation logging for detection coverage." -ForegroundColor Yellow
}

Write-Host "=== AppLocker / WDAC Policy Presence ===" -ForegroundColor Cyan
Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue | Out-Null
if ($?) { Write-Host "AppLocker effective policy present - verify script rules cover Siemens paths." }
else { Write-Host "No effective AppLocker policy found - consider WDAC/AppLocker to block script execution under user context." -ForegroundColor Yellow }

Write-Host "=== Network Exposure Check (listening services on host) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.OwningProcess -in (Get-Process | Where-Object { $_.Path -match 'Desigo|Siemens' }).Id } |
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize