Defending Critical Infrastructure: Iranian Threats to Siemens, Schneider, and Rockwell PLCs

---
title: Potential ICS Protocol Abuse via Scripting Tools
id: 9c8f7d6e-5b4a-4c3d-8e2f-1a0b9c8d7e6f
status: experimental
description: Detects scripting interpreters or command shells connecting to common ICS protocol ports (Siemens S7, Rockwell CIP, Modbus). This indicates potential custom exploit tooling rather than standard engineering software usage.
references:
 - https://www.cisa.gov/news-events/cybersecurity-advisories
author: Security Arsenal
date: 2026/04/10
tags:
 - attack.initial_access
 - attack.t1190
 - attack.ics
logsource:
 category: network_connection
 product: windows
detection:
 selection_ports:
   DestinationPort:
     - 102  # Siemens S7Comm
     - 44818 # Rockwell/EIP CIP
     - 240  # Rockwell PCCC
     - 502  # Modbus TCP
 selection_process:
   Image|endswith:
     - '\python.exe'
     - '\python3.exe'
     - '\pwsh.exe'
     - '\powershell.exe'
     - '\cmd.exe'
     - '\bash.exe'
 condition: all of selection_*
falsepositives:
 - Legitimate scripting for ICS data collection (rare in OT envs)
level: high
---
title: Engineering Software Spawning Shell
id: b1a2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects core ICS engineering applications (Siemens, Rockwell, Schneider) spawning cmd.exe or powershell.exe. This may indicate an exploit chain or suspicious post-exploitation activity.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
tags:
 - attack.execution
 - attack.t1059.003
 - attack.ics
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
   ParentImage|contains:
     - 'Siemens'
     - 'Rockwell'
     - 'Schneider'
   ParentImage|endswith:
     - '\Portal.exe'      # Siemens TIA
     - '\Studio5000.exe'  # Rockwell
     - '\UnityPro.exe'    # Schneider
 selection_child:
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 condition: all of selection_*
falsepositives:
 - Administrative troubleshooting by engineers (verify context)
level: high

let OT_Ports = dynamic([102, 44818, 240, 502]);
DeviceNetworkEvents
| where RemotePort in (OT_Ports)
| where InitiatingProcessFileName in ("python.exe", "python3.exe", "pwsh.exe", "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc

-- Hunt for processes connecting to ICS ports or running Engineering software
SELECT Pid, Name, Exe, Username, CommandLine, 
       parse_string(data=Cmdline, regex='.*--port\s*(\d+).*').0 as PortArgs
FROM pslist()
WHERE Name =~ 'Siemens' OR Name =~ 'Rockwell' OR Name =~ 'UnityPro' 
   OR Name =~ 'python' OR Name =~ 'powershell'

-- Check active connections to common ICS ports
SELECT RemoteAddress, RemotePort, State, Pid, ProcessName
FROM netstat()
WHERE RemotePort IN (102, 44818, 240, 502)

# Audit Script: ICS Exposure Check
Write-Host "[+] Auditing ICS Engineering Workstation Security..." -ForegroundColor Cyan

# 1. Check for listeners on critical OT ports
$OTPorts = @(102, 44818, 240, 502)
$Listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $OTPorts -contains $_.LocalPort }

if ($Listeners) {
    Write-Host "[!] WARNING: Listeners found on critical OT ports!" -ForegroundColor Red
    $Listeners | Format-Table LocalAddress, LocalPort, OwningProcess
    $Listeners | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue | Select-ProcessName, Path }
} else {
    Write-Host "[+] No listeners found on standard ICS ports (102, 44818, 240, 502)." -ForegroundColor Green
}

# 2. Inventory ICS Software
Write-Host "\n[+] Checking for installed ICS Engineering Software..."
$RegPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$ICSApps = Get-ItemProperty $RegPaths -ErrorAction SilentlyContinue | 
    Where-Object { $_.DisplayName -match "Siemens|Rockwell|Schneider|TIA|Unity|Studio 5000" } |
    Select-Object DisplayName, DisplayVersion, Publisher

if ($ICSApps) {
    $ICSApps | Format-Table -AutoSize
} else {
    Write-Host "[-] No major vendor engineering software found in registry." -ForegroundColor Gray
}