CVE-2026-78556 & CVE-2026-78557: Siemens Industrial Edge App Publisher RCE — Detection and Remediation Guide

---
title: Siemens Industrial Edge App Publisher Spawning Suspicious Child Process
id: 3f8c1a7e-9b2d-4e5f-a6c7-8d9e0f1a2b3c
status: experimental
description: Detects the Industrial Edge App Publisher process spawning shells, scripting engines, or command interpreters — consistent with post-exploitation activity following CVE-2026-78556/CVE-2026-78557 Node.js code execution.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'App Publisher'
      - 'Industrial Edge'
    ParentImage|endswith:
      - '\\node.exe'
      - '\\electron.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\rundll32.exe'
      - '\\regsvr32.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
      - '\\whoami.exe'
      - '\\net.exe'
      - '\\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate App Publisher operation should not spawn command interpreters. Validate any hit against change control.
level: high
---
title: Node.js Runtime Executing Outside Application Directories on Engineering Workstations
id: 6a1d4f92-3c8b-4e7a-b5d2-1f0e9c8a7b6d
status: experimental
description: Detects node.exe executing from user-writable or temporary paths, a common artifact when injected script content drops and executes payloads after Electron/Node.js code execution (CVE-2026-78557).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.007
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\node.exe'
  filter_paths:
    Image|contains:
      - '\\Program Files\\'
      - '\\Program Files (x86)\\'
      - '\\AppData\\Local\\Programs\\'
  condition: selection and not filter_paths
falsepositives:
  - Developer workstations running portable Node.js tooling — scope this rule to hosts with Industrial Edge App Publisher installed.
level: medium
---
title: ARP Spoofing or Gateway Impersonation Artifacts on OT DMZ Segments
id: 9c2e5b18-4d7f-4a6c-8e1b-2a3f5d7c9e0b
status: experimental
description: Detects network patterns consistent with attacker-in-the-middle positioning (duplicate MAC for gateway/IEM server IP) on segments hosting Industrial Edge publisher workstations, a prerequisite for CVE-2026-78556 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
  - https://attack.mitre.org/techniques/T1557/002/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.collection
  - attack.credential_access
  - attack.t1557.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - 'App Publisher'
      - 'Industrial Edge'
    DestinationPort:
      - 443
      - 9443
      - 8080
  filter_known_iem:
    DestinationIp:
      - '10.0.0.0/8'
  condition: selection and not filter_known_iem
falsepositives:
  - Replace filter_known_iem CIDRs with your actual IEM server addresses; legitimate cloud update endpoints may need tuning.
level: medium

// Hunt: App Publisher or Node.js spawning command interpreters on engineering workstations
// Run in Microsoft Sentinel / Defender (DeviceProcessEvents). Tune parent process name to your build.
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "whoami.exe", "net.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("App Publisher", "node.exe", "electron.exe")
   or InitiatingProcessFolderPath has_any ("Industrial Edge", "App Publisher")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Corollary hunt: TLS connections from publisher hosts to non-IEM destinations on management ports
// Requires Syslog/CEF ingestion of firewall or proxy logs into CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (443, 9443, 8080)
| where SourceHostName has_any ("ENG", "EWS")  // scope to engineering workstation naming convention
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationHostName, DestinationPort
| where ConnectionCount < 50   // low-frequency destinations are more interesting than high-volume update CDNs
| order by LastSeen desc;

-- Artifact: Windows.Hunt.SiemensAppPublisherAnomalies
-- Hunt publisher workstations for unexpected child processes of the App Publisher / Node runtime
-- and for persistence artifacts created after the advisory disclosure date.

LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(App Publisher|Industrial\\s*Edge|node\.exe)'
   OR CommandLine =~ '(?i)(powershell|cmd\.exe|mshta|rundll32|certutil)'

LET persistence_hunt = SELECT Name AS RunKey, String.Value AS Command, Mtime AS KeyModified
FROM glob(glob='HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
          accessor='reg')
WHERE KeyModified > '2026-06-01T00:00:00Z'

SELECT * FROM proc_hunt

# CVE-2026-78556 / CVE-2026-78557 — Siemens Industrial Edge App Publisher verification & hardening
# Run elevated on each engineering workstation that has the App Publisher installed.

# 1) Locate installed App Publisher instances and report versions
$paths = @(
    "$env:ProgramFiles",
    "${env:ProgramFiles(x86)}",
    "$env:LOCALAPPDATA\Programs"
)
$found = Get-ChildItem -Path $paths -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match "App Publisher" -or $_.DirectoryName -match "Industrial Edge" } |
    Select-Object FullName, @{N='FileVersion';E={$_.VersionInfo.FileVersion}},
                  @{N='ProductVersion';E={$_.VersionInfo.ProductVersion}}

if ($found) {
    $found | Format-Table -AutoSize
    $vulnerable = $found | Where-Object {
        [version]($_.ProductVersion -replace '[^0-9.].*$','') -lt [version]'1.27.9'
    }
    if ($vulnerable) {
        Write-Warning "VULNERABLE: App Publisher < 1.27.9 detected. Update immediately via Siemens support portal."
    } else {
        Write-Host "OK: App Publisher version is 1.27.9 or later." -ForegroundColor Green
    }
} else {
    Write-Host "App Publisher not found on this host." -ForegroundColor Yellow
}

# 2) Quick post-exploitation sweep: child processes of node/electron spawned in the last 14 days
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match 'node\.exe|App Publisher' -or $_.ExecutablePath -match 'Industrial Edge'
} | Select-Object ProcessId, ParentProcessId, Name, CommandLine, CreationDate | Format-List

# 3) Verify TLS interception is not in play: inspect trusted root stores for non-standard CAs
Get-ChildItem Cert:\LocalMachine\Root | Where-Object {
    $_.Issuer -notmatch 'Microsoft|DigiCert|GlobalSign|Siemens' -and $_.NotAfter -gt (Get-Date)
} | Select-Object Subject, Issuer, Thumbprint | Format-Table -AutoSize

# 4) Network hygiene: confirm App Publisher hosts resolve IEM only to expected infrastructure
# Replace with your actual IEM FQDN
$iemFqdn = 'iem.your-domain.example'
Resolve-DnsName -Name $iemFqdn -ErrorAction SilentlyContinue | Select-Object Name, IPAddress