CVE-2026-63017 & CVE-2026-63774: Critical SQL Injection and Authorization Bypass in Subnet Solutions PowerSYSTEM Center — ICS Defense Guide

---
title: PowerSYSTEM Center SQL Injection Attempt in URI
description: Detects common SQL injection patterns in HTTP requests targeting PowerSYSTEM Center web interface
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
author: Security Arsenal
date: 2026/11/04
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - "'"
      - "--"
      - "/*"
      - "@@"
      - "char("
      - "nchar("
      - "varchar("
      - "alter table"
      - "begin"
      - "cast("
      - "create"
      - "cursor"
      - "declare"
      - "delete"
      - "drop"
      - "end"
      - "exec"
      - "execute"
      - "fetch"
      - "insert"
      - "kill"
      - "open"
      - "select"
      - "sys"
      - "sysobjects"
      - "syscolumns"
      - "table"
      - "update"
  condition: selection
falsepositives:
  - Legitimate application use of special characters in search or filter functions
level: high
---
title: Suspicious Process Spawned by Web Server
description: Detects web server or application pool processes spawning command shells or scripting engines, indicative of SQL injection leading to command execution
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
author: Security Arsenal
date: 2026/11/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts or maintenance tasks executed by system administrators
level: high
---
title: Database Service Account Executing Suspicious Commands
description: Detects database service accounts executing operating system commands or accessing sensitive database objects, which may indicate post-exploitation activity following SQL injection
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
author: Security Arsenal
date: 2026/11/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains:
      - 'MSSQL'
      - 'SQLSERVER'
      - 'NT SERVICE\MSSQL'
      - 'NT SERVICE\SQL'
  selection_command:
    CommandLine|contains:
      - 'xp_cmdshell'
      - 'sp_oacreate'
      - 'sp_oamethod'
      - 'cmd.exe'
      - 'powershell'
      - 'whoami'
      - 'net user'
      - 'net localgroup'
      - 'ipconfig'
      - 'systeminfo'
  condition: selection_user and selection_command
falsepositives:
  - Database administrators performing legitimate maintenance
level: high

// Hunt for SQL injection patterns in web requests to PowerSYSTEM Center
let timeRange = 24h;
let sqlPatterns = dynamic(["'", "--", "/*", "@@", "char(", "nchar(", "varchar(", "alter table", "cast(", "declare", "delete", "drop", "exec", "execute", "insert", "select", "sys", "sysobjects", "syscolumns", "update"]);
CommonSecurityLog
| where TimeGenerated > ago(timeRange)
| where DeviceProduct contains "PowerSYSTEM" or RequestURL contains "PowerSYSTEM" or RequestURL contains "psc"
| extend UriQuery = tostring(RequestURL)
| where UriQuery has_any (sqlPatterns)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceAction, DeviceProduct
| order by TimeGenerated desc

// Hunt for suspicious processes spawned by web server or database service accounts
let timeRange = 24h;
let webServerProcesses = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(timeRange)
| where InitiatingProcessFileName has_any (webServerProcesses)
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, AccountDomain
| order by TimeGenerated desc

// Hunt for database service accounts executing OS commands
let timeRange = 24h;
let suspiciousCommands = dynamic(["xp_cmdshell", "sp_oacreate", "cmd.exe", "powershell", "whoami", "net user", "net localgroup", "ipconfig", "systeminfo"]);
SecurityEvent
| where TimeGenerated > ago(timeRange)
| where EventID == 4688
| where SubjectUserName contains "MSSQL" or SubjectUserName contains "SQLSERVER" or SubjectUserName contains "NT SERVICE"
| where CommandLine has_any (suspiciousCommands)
| project TimeGenerated, Computer, SubjectUserName, NewProcessName, CommandLine, ParentProcessName
| order by TimeGenerated desc

// Correlate web injection attempts with subsequent process execution on the same host
let timeRange = 24h;
let webEvents = CommonSecurityLog
| where TimeGenerated > ago(timeRange)
| where RequestURL has_any ("'", "--", "select", "union", "exec")
| project WebTime=TimeGenerated, WebHost=DestinationHostName, SourceIP, RequestURL;
let processEvents = DeviceProcessEvents
| where TimeGenerated > ago(timeRange)
| where InitiatingProcessFileName =~ "w3wp.exe"
| project ProcessTime=TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine;
webEvents
| join kind=inner (processEvents) on $left.WebHost == $right.DeviceName
| where ProcessTime > WebTime and ProcessTime < WebTime + 10m
| project WebTime, WebHost, SourceIP, RequestURL, ProcessTime, FileName, ProcessCommandLine
| order by WebTime desc

-- Hunt for PowerSYSTEM Center exploitation artifacts
SELECT * FROM foreach(
  row={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
    WHERE CommandLine =~ "(cmd|powershell|pwsh|cscript|wscript|mshta|rundll32|regsvr32|certutil|bitsadmin)"
      AND (Username =~ "(MSSQL|SQLSERVER|IIS|NETWORK SERVICE|SYSTEM)" OR Exe =~ "(w3wp|httpd|nginx)")
  },
  query={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
           "Suspicious Process" AS ArtifactType
    FROM scope()
  }
)
UNION ALL
SELECT * FROM foreach(
  row={
    SELECT FullPath, Size, Mtime, Atime, Ctime
    FROM glob(globs="C:\\inetpub\\wwwroot\\**", accessor="file")
    WHERE Mtime > now() - 86400  -- Last 24 hours
      AND (FullPath =~ "\\.(aspx|asp|php|jsp|config|xml|json)$")
  },
  query={
    SELECT NULL AS Pid, NULL AS Name, NULL AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime,
           "Recently Modified Web File" AS ArtifactType, FullPath, Size, Mtime
    FROM scope()
  }
)
UNION ALL
SELECT * FROM foreach(
  row={
    SELECT Pid, Name, RemoteAddr, RemotePort, State
    FROM netstat()
    WHERE RemotePort IN (80, 443, 1433, 1434)  -- HTTP, HTTPS, MS SQL
      AND State =~ "ESTABLISHED"
  },
  query={
    SELECT Pid, Name, NULL AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime,
           "Network Connection" AS ArtifactType, RemoteAddr, RemotePort, State
    FROM scope()
  }
)

# PowerSYSTEM Center Vulnerability Assessment and Mitigation Script
# Run with elevated privileges on the PowerSYSTEM Center host or a management server

param(
    [string]$InstallPath = "C:\Program Files\Subnet Solutions\PowerSYSTEM Center",
    [string]$LogPath = "C:\Logs\PSC_Security_Check_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
)

# Create log directory
New-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "[$timestamp] [$Level] $Message"
    Add-Content -Path $LogPath -Value $logEntry
    Write-Host $logEntry
}

Write-Log "Starting PowerSYSTEM Center security assessment"

# 1. Identify installed version
Write-Log "Checking for PowerSYSTEM Center installation..."
$installInfo = Get-ChildItem -Path $InstallPath -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue | 
    Select-Object -First 1 -Property Name, @{N='Version';E={$_.VersionInfo.ProductVersion}}, FullName

if ($installInfo) {
    Write-Log "Found PowerSYSTEM Center: $($installInfo.Name) Version $($installInfo.Version)" "INFO"
    
    # Check if version is vulnerable
    $version = [version]$installInfo.Version
    $isVulnerable = $false
    $vulnerableCVEs = @()
    
    if ($version.Major -eq 5 -and $version.Minor -le 29) {
        $isVulnerable = $true
        $vulnerableCVEs += "CVE-2026-63017"
    }
    elseif ($version.Major -eq 6 -and $version.Minor -ge 0 -and $version.Minor -le 2) {
        $isVulnerable = $true
        $vulnerableCVEs += "CVE-2026-63017", "CVE-2026-63774"
    }
    elseif ($version.Major -eq 7 -and $version.Minor -ge 0 -and $version.Minor -le 1) {
        $isVulnerable = $true
        $vulnerableCVEs += "CVE-2026-63017", "CVE-2026-63774"
    }
    
    if ($isVulnerable) {
        Write-Log "VULNERABLE VERSION DETECTED: $($installInfo.Version)" "WARNING"
        Write-Log "Associated CVEs: $($vulnerableCVEs -join ', ')" "WARNING"
    } else {
        Write-Log "Installed version appears to be patched or not in the affected range." "INFO"
    }
} else {
    Write-Log "PowerSYSTEM Center not found at $InstallPath" "WARNING"
}

# 2. Check for network exposure
Write-Log "Checking network listening ports..."
$listeningPorts = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | 
    Where-Object { $_.LocalPort -in @(80, 443, 1433, 1434, 8080, 8443) } | 
    Select-Object LocalAddress, LocalPort, OwningProcess

foreach ($port in $listeningPorts) {
    $process = Get-Process -Id $port.OwningProcess -ErrorAction SilentlyContinue
    Write-Log "Port $($port.LocalPort) listening on $($port.LocalAddress) - Process: $($process.Name)" "INFO"
    
    if ($port.LocalAddress -eq "0.0.0.0" -or $port.LocalAddress -eq "::") {
        Write-Log "WARNING: Service is listening on all interfaces. Consider restricting to localhost or management VLAN." "WARNING"
    }
}

# 3. Check Windows Firewall rules for PowerSYSTEM Center
Write-Log "Checking Windows Firewall rules..."
$fwRules = Get-NetFirewallRule -DisplayName "*PowerSYSTEM*" -ErrorAction SilentlyContinue
if ($fwRules) {
    foreach ($rule in $fwRules) {
        Write-Log "Firewall Rule: $($rule.DisplayName) - Enabled: $($rule.Enabled) - Direction: $($rule.Direction) - Action: $($rule.Action)" "INFO"
    }
} else {
    Write-Log "No specific firewall rules found for PowerSYSTEM Center." "INFO"
}

# 4. Apply temporary network-level mitigations (optional)
Write-Log "Applying temporary mitigations..." "INFO"
Write-Log "NOTE: These are temporary measures. Apply the vendor patch as soon as possible." "WARNING"

# Block external access to web interface (allow only from management network)
$managementNetwork = "10.0.0.0/8"  # Modify to your actual management network
$ruleName = "PSC_Block_External_Web_Access"

if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
    try {
        New-NetFirewallRule -DisplayName $ruleName -Direction Inbound -Protocol TCP -LocalPort 80,443 -RemoteAddress Any -Action Block -ErrorAction Stop
        Write-Log "Created firewall rule: $ruleName (Blocks external web access)" "INFO"
        
        # Allow from management network
        $allowRule = "PSC_Allow_Mgmt_Web_Access"
        New-NetFirewallRule -DisplayName $allowRule -Direction Inbound -Protocol TCP -LocalPort 80,443 -RemoteAddress $managementNetwork -Action Allow -ErrorAction Stop
        Write-Log "Created firewall rule: $allowRule (Allows from $managementNetwork)" "INFO"
    } catch {
        Write-Log "Failed to create firewall rules: $_" "ERROR"
    }
} else {
    Write-Log "Firewall mitigation rules already exist." "INFO"
}

# 5. Enable detailed logging for IIS (if applicable)
Write-Log "Checking IIS logging configuration..."
$iisSites = Get-Website -ErrorAction SilentlyContinue
if ($iisSites) {
    foreach ($site in $iisSites) {
        $logFile = Get-WebConfigurationProperty -Filter "system.applicationHost/sites/site[@name='$($site.Name)']/logFile" -Name "enabled" -ErrorAction SilentlyContinue
        if ($logFile.Value -eq $false) {
            Write-Log "Enabling detailed logging for site: $($site.Name)" "INFO"
            Set-WebConfigurationProperty -Filter "system.applicationHost/sites/site[@name='$($site.Name)']/logFile" -Name "enabled" -Value $true
        }
    }
}

# 6. Recommendations
Write-Log "`n=== RECOMMENDATIONS ===" "INFO"
Write-Log "1. Apply the vendor patch immediately. Contact Subnet Solutions for updated versions." "INFO"
Write-Log "2. If patching is not immediately possible, isolate PowerSYSTEM Center from untrusted networks." "INFO"
Write-Log "3. Implement strict network segmentation between IT and OT networks." "INFO"
Write-Log "4. Review web and database logs for indicators of compromise (see Sigma/KQL rules in associated blog post)." "INFO"
Write-Log "5. Change all database and application service account passwords if compromise is suspected." "INFO"
Write-Log "6. Monitor for unauthorized configuration changes or new user accounts in PowerSYSTEM Center." "INFO"

Write-Log "Assessment complete. Log saved to: $LogPath"