CVE-2026-50093: Siemens Siveillance Control OIS Arbitrary File Upload — Detection and Remediation Guide

---
title: OIS Web Service Spawning Command Interpreter or Scripting Engine
id: 8f3a2b71-4c6d-4e19-9a52-7d1e5c8b3f04
status: experimental
description: Detects the Siveillance OIS web module or associated web server worker processes spawning command interpreters or scripting engines, consistent with post-exploitation after arbitrary file upload (CVE-2026-50093).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-03
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  filter_known_ois:
    CommandLine|contains:
      - 'Siveillance'
  condition: selection_parent and selection_child and not filter_known_ois
falsepositives:
  - Legitimate OIS maintenance scripts invoked by Siemens update installers
  - Documented administrative automation on the Siveillance host
level: high
---
title: Script or Executable File Written to OIS Web Directory
id: 2c7d91e4-6a3f-4b58-8d27-9f0a4e6c1b85
status: experimental
description: Detects creation of script, web shell, or executable file types in Siveillance OIS web module directories or common web roots, consistent with arbitrary file upload exploitation (CVE-2026-50093).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-03
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_creation
  product: windows
detection:
  selection_extension:
    TargetFilename|endswith:
      - '.aspx'
      - '.asmx'
      - '.ashx'
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.py'
  selection_path:
    TargetFilename|contains:
      - '\OIS\'
      - '\Siveillance\'
      - '\inetpub\wwwroot\'
      - '\htdocs\'
      - '\webapps\'
      - '\wwwroot\'
  condition: selection_extension and selection_path
falsepositives:
  - Siemens OIS product updates and installers (correlate with maintenance windows and signed installer activity)
  - Legitimate customization deployments by integrators
level: high
---
title: Webshell-Like Reconnaissance Command from Web Server Context
id: 5b1e8c34-7d92-4f06-a381-2e9c6d4f8a17
status: experimental
description: Detects typical first-commands executed through a freshly uploaded web shell (identity, network, and system discovery) spawned under a web service parent process.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-03
  - https://attack.mitre.org/techniques/T1033/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1016
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\tomcat.exe'
  selection_cmd:
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig'
      - 'net user'
      - 'net localgroup'
      - 'systeminfo'
      - 'quser'
      - 'netstat -an'
      - 'arp -a'
  condition: selection_parent and selection_cmd
falsepositives:
  - Rare; web application pools do not normally execute system discovery commands
level: critical

let WebParents = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "java.exe", "javaw.exe", "tomcat.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe"]);
let ScriptExtensions = dynamic([".aspx", ".asmx", ".ashx", ".php", ".jsp", ".exe", ".dll", ".bat", ".ps1", ".py"]);
union isfuzzy=true
  (DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where InitiatingProcessFileName in~ (WebParents)
  | where FileName in~ (SuspiciousChildren)
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteDeviceIP = InitiatingProcessIP,
    ReportId, Source = "DeviceProcessEvents"),
  (SecurityEvent
  | where TimeGenerated > ago(14d)
  | where EventID == 4688
  | where ParentProcessName has_any (WebParents)
  | where NewProcessName has_any (SuspiciousChildren)
  | project TimeGenerated, DeviceName = Computer, InitiatingProcessFileName = ParentProcessName, InitiatingProcessCommandLine = "", FileName = NewProcessName, ProcessCommandLine = CommandLine, AccountName = SubjectAccount, InitiatingProcessRemoteDeviceIP = "",
    ReportId = "", Source = "SecurityEvent"),
  (DeviceFileEvents
  | where TimeGenerated > ago(14d)
  | where FolderPath has_any ("\\OIS\\", "\\Siveillance\\", "\\inetpub\\", "\\htdocs\\", "\\webapps\\", "\\wwwroot\\")
  | where FileName has_any (ScriptExtensions)
  | where ActionType == "FileCreated"
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine = FolderPath, AccountName = InitiatingProcessAccountName, InitiatingProcessRemoteDeviceIP = "",
    ReportId, Source = "DeviceFileEvents")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, Source
| order by LastSeen desc

-- Hunt for suspicious files in OIS/web directories and webshell-spawned processes on Siveillance hosts
-- CVE-2026-50093 post-exploitation sweep

LET web_dirs <= SELECT FullPath AS Dir FROM glob(globs=[
  'C:/Program Files*/**/OIS/**',
  'C:/**/Siveillance/**',
  'C:/inetpub/wwwroot/**',
  'C:/**/webapps/**',
  'C:/**/htdocs/**'
])

LET suspicious_files <= SELECT FullPath, Size, Mtime AS ModifiedTime, Ctime AS CreatedTime
FROM glob(globs=[
  'C:/inetpub/wwwroot/**.aspx',
  'C:/inetpub/wwwroot/**.ashx',
  'C:/inetpub/wwwroot/**.exe',
  'C:/**/OIS/**.aspx',
  'C:/**/OIS/**.exe',
  'C:/**/OIS/**.ps1',
  'C:/**/OIS/**.bat',
  'C:/**/Siveillance/**/upload*/**'
])
WHERE Mtime > now() - 1209600  -- files modified in last 14 days

LET webshell_procs <= SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
  get_process(pid=Ppid).Name AS ParentName, Ppid
FROM pslist()
WHERE get_process(pid=Ppid).Name =~ '(w3wp|httpd|nginx|java|tomcat)'
  AND Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|whoami|net)'

SELECT 'SuspiciousFile' AS Finding, FullPath AS Detail1, CreatedTime AS Detail2, ModifiedTime AS Detail3, Size AS Detail4, '' AS Detail5 FROM suspicious_files
UNION ALL
SELECT 'WebshellProcess' AS Finding, CommandLine AS Detail1, CreateTime AS Detail2, ParentName AS Detail3, Username AS Detail4, Exe AS Detail5 FROM webshell_procs

# CVE-2026-50093 - Siemens Siveillance OIS Exposure Assessment
# Run elevated on the Siveillance/OIS server

Write-Host "=== Siveillance OIS Vulnerability Assessment (CVE-2026-50093) ===" -ForegroundColor Cyan

# 1. Enumerate installed Siemens / Siveillance products and versions
$installed = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
             "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
             Where-Object { $_.DisplayName -match 'Siveillance|OIS|Siemens' } |
             Select-Object DisplayName, DisplayVersion, InstallDate, Publisher

if ($installed) {
    Write-Host "`n[+] Installed Siemens components:" -ForegroundColor Green
    $installed | Format-Table -AutoSize
} else {
    Write-Host "`n[-] No Siveillance/OIS components found in registry uninstall keys. Verify manually." -ForegroundColor Yellow
}

# 2. Check OIS version against fixed thresholds
# Fixed: Pro V3.0 >= 3.0.12.2173 | Pro V4.0 >= 4.0.9.2178 | Control V3.0 >= 3.0.22.2177
$fixedBuilds = @('3.0.12.2173','4.0.9.2178','3.0.22.2177')
foreach ($app in $installed) {
    if ($app.DisplayName -match 'OIS' -and $app.DisplayVersion) {
        try {
            $v = [version]$app.DisplayVersion
            $vulnerable = $true
            foreach ($f in $fixedBuilds) {
                $fv = [version]$f
                if ($v.Major -eq $fv.Major -and $v.Minor -eq $fv.Minor -and $v -ge $fv) { $vulnerable = $false }
            }
            $status = if ($vulnerable) { "VULNERABLE - update required" } else { "Patched or unaffected build" }
            $color  = if ($vulnerable) { 'Red' } else { 'Green' }
            Write-Host "[!] $($app.DisplayName) $($app.DisplayVersion): $status" -ForegroundColor $color
        } catch { Write-Host "[?] Could not parse version $($app.DisplayVersion) - check manually." -ForegroundColor Yellow }
    }
}

# 3. Sweep web directories for recently created script/executable files (last 14 days)
Write-Host "`n[+] Scanning web directories for recently created script/executable files..." -ForegroundColor Green
$searchPaths = @("C:\inetpub\wwwroot", "C:\Program Files\Siemens", "C:\Program Files (x86)\Siemens")
$extensions  = @('*.aspx','*.ashx','*.asmx','*.php','*.jsp','*.exe','*.ps1','*.bat','*.dll')
$cutoff = (Get-Date).AddDays(-14)
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include $extensions -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $cutoff } |
        Select-Object FullName, LastWriteTime, CreationTime, Length |
        Format-Table -AutoSize
    }
}

# 4. Audit local administrators for unauthorized additions
Write-Host "`n[+] Local Administrators group membership:" -ForegroundColor Green
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize

# 5. List listening ports to identify the OIS web interface exposure
Write-Host "`n[+] Listening TCP ports (identify OIS web interface exposure):" -ForegroundColor Green
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 80,443,8080,8443,9000,9443 } |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Sort-Object LocalPort | Format-Table -AutoSize

Write-Host "`n=== Assessment complete. Review findings and apply Siemens OIS updates per ICSA-26-265-03. ===" -ForegroundColor Cyan