Ecava IntegraXor IGX 16.0.701.10 Remote Code Execution: Defending SCADA/HMI Systems Against a Public PoC

---
title: Ecava IntegraXor IGX Server Spawning Shell or Scripting Process
description: Detects the IntegraXor SCADA/HMI server process spawning command shells, scripting engines, or LOLBins — a strong indicator of remote code execution against the IGX web service (public PoC, Exploit-DB 52688).
references:
  - https://www.exploit-db.com/exploits/52688
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 3f9a2c71-4e8d-4b5a-9c1f-7d2e6a0b8143
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\IntegraXor.exe'
      - '\IGXServer.exe'
      - '\IGX.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — legitimate IGX maintenance scripts run interactively by engineers; validate against change windows
level: critical
---
title: File Drop in Ecava IntegraXor Web Root or Public Directories by IGX Process
description: Detects the IntegraXor server process writing executable or script files to web-accessible or world-writable directories, consistent with web shell deployment following RCE against the IGX service.
references:
  - https://www.exploit-db.com/exploits/52688
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 8b1d4e62-9f3a-4c7b-a2e5-1c6d9f034782
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith:
      - '\IntegraXor.exe'
      - '\IGXServer.exe'
      - '\IGX.exe'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.vbs'
      - '.js'
      - '.aspx'
      - '.asp'
      - '.php'
  selection_path:
    TargetFilename|contains:
      - '\Users\Public\'
      - '\Temp\'
      - '\Windows\Temp\'
      - '\ProgramData\'
      - 'IntegraXor'
  condition: selection_source and selection_ext and selection_path
falsepositives:
  - IGX self-update or installer activity — correlate with authorized patch/upgrade windows
level: high
---
title: Inbound Network Connection to IntegraXor Default Web Port from Non-OT Source
description: Detects inbound connections to the IntegraXor IGX default web service port (TCP 7131) originating outside expected operator/engineering segments, indicating scanning or exploitation attempts against the IGX server.
references:
  - https://www.exploit-db.com/exploits/52688
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 5c2e7a19-6d4b-4f08-b3a1-2e8c5d709164
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 7131
    Initiated: 'true'
    Image|endswith:
      - '\IntegraXor.exe'
      - '\IGXServer.exe'
      - '\IGX.exe'
  condition: selection
falsepositives:
  - Legitimate operator HMI browser sessions — whitelist known operator workstation and engineering subnet IPs at the SIEM layer; any residual hits from outside those ranges are investigative leads
level: high

// Hunt 1: IGX server spawning suspicious child processes (RCE indicator)
let IGXProcesses = dynamic(["IntegraXor.exe", "IGXServer.exe", "IGX.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "ipconfig.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (IGXProcesses)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteSessionIPV4Address, ReportId
| sort by TimeGenerated desc;

// Hunt 2: Inbound connections to IGX default port 7131 from unexpected sources
let AllowedSubnets = dynamic(["10.20.30."]); // TODO: replace with your operator/engineering subnets
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where LocalPort == 7131
| where InitiatingProcessFileName in~ (dynamic(["IntegraXor.exe", "IGXServer.exe", "IGX.exe"]))
| extend RemoteIPStr = tostring(RemoteIP)
| where not(RemoteIPStr has_any (AllowedSubnets)) and not(RemoteIPStr startswith "10.") and not(RemoteIPStr startswith "192.168.") and not(RemoteIPStr startswith "172.16.")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| sort by ConnectionCount desc;

// Hunt 3: Executable/script drops attributable to the IGX process
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (dynamic(["IntegraXor.exe", "IGXServer.exe", "IGX.exe"]))
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bat" or FileName endswith ".ps1" or FileName endswith ".vbs" or FileName endswith ".js" or FileName endswith ".aspx" or FileName endswith ".php"
| where FolderPath has_any ("\\Users\\Public\\", "\\Temp\\", "\\Windows\\Temp\\", "\\ProgramData\\", "IntegraXor")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc;

-- Hunt: Ecava IntegraXor RCE post-exploitation indicators
-- Looks for child processes spawned by the IGX server and file drops in
-- world-writable / web-accessible locations (Exploit-DB 52688 context)

LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)cmd\.exe|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|whoami|net(1)?\.exe'

LET resolved = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       (SELECT Name FROM pslist(pid=proc_hunt.Ppid)) AS ParentInfo
FROM proc_hunt

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       ParentInfo[0].Name AS ParentName
FROM resolved
WHERE ParentName =~ '(?i)integraxor|igxserver|igx\.exe'

-- Companion file hunt (run separately if desired):
-- SELECT FullPath, Size, Mtime, Ctime FROM glob(globs='C:/Users/Public/**/*.exe')
-- UNION SELECT FullPath, Size, Mtime, Ctime FROM glob(globs='C:/Windows/Temp/*.exe')
-- ORDER BY Mtime DESC

# Ecava IntegraXor IGX - Exposure Assessment and Compensating Controls
# Run elevated on the suspected IGX host. Review output before applying blocks.

$ErrorActionPreference = 'Continue'
$report = @()

# 1. Identify installed IntegraXor version
$igx = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
        HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
        Where-Object { $_.DisplayName -match 'IntegraXor|IGX' } |
        Select-Object DisplayName, DisplayVersion, InstallLocation
if ($igx) {
    $report += "[FOUND] Installed: $($igx.DisplayName) - Version $($igx.DisplayVersion)"
    if ($igx.DisplayVersion -match '16\.0\.701\.10') {
        $report += "[VULNERABLE] Version 16.0.701.10 matches the publicly exploited build."
    }
} else {
    $report += "[INFO] No IntegraXor installation detected via registry uninstall keys."
}

# 2. Check whether the IGX web port is listening and which process owns it
$listeners = Get-NetTCPConnection -State Listen -LocalPort 7131 -ErrorAction SilentlyContinue
foreach ($l in $listeners) {
    $proc = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
    $report += "[EXPOSED] TCP 7131 LISTENING - Process: $($proc.ProcessName) (PID $($l.OwningProcess)) Path: $($proc.Path)"
}

# 3. Compensating control: restrict TCP 7131 to authorized operator subnet only
#    EDIT $AllowedSubnet before running. Set $ApplyBlock = $true to enforce.
$ApplyBlock   = $false
$AllowedSubnet = '10.20.30.0/24'   # TODO: replace with your operator/engineering subnet

if ($ApplyBlock) {
    New-NetFirewallRule -DisplayName 'IGX-Block-7131-External' -Direction Inbound `
        -Protocol TCP -LocalPort 7131 -Action Block `
        -RemoteAddress Any -Profile Any -ErrorAction SilentlyContinue | Out-Null
    New-NetFirewallRule -DisplayName 'IGX-Allow-7131-Operators' -Direction Inbound `
        -Protocol TCP -LocalPort 7131 -Action Allow `
        -RemoteAddress $AllowedSubnet -Profile Any -ErrorAction SilentlyContinue | Out-Null
    $report += "[ACTION] Firewall rules applied: 7131 allowed only from $AllowedSubnet, blocked otherwise."
    $report += "[ACTION] Verify operator HMI access immediately after applying."
} else {
    $report += "[DRY-RUN] Set `$ApplyBlock = `$true and configure `$AllowedSubnet to enforce the compensating firewall rule."
}

# 4. Recent suspicious child processes of IGX (last 14 days, requires process auditing/Sysmon)
$events = Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'IntegraXor\.exe|IGXServer\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe|rundll32\.exe|certutil\.exe' } |
    Select-Object TimeCreated, Message -First 25
if ($events) {
    $report += "[ALERT] Suspicious IGX child process events found - escalate to IR:"
    $events | ForEach-Object { $report += ($_.TimeCreated.ToString() + ' :: ' + ($_.Message -split "`n")[0]) }
} else {
    $report += "[INFO] No suspicious IGX child-process events in Security log (or 4688 auditing not enabled)."
}

$report | ForEach-Object { Write-Output $_ }