ICS Advisory: Siemens KACO Blueplanet Inverters — Hardening Against Serial Number Derivation Attacks

---
title: Potential Reconnaissance of KACO Inverters via SNMP
id: 8a4c2d10-5e67-4f12-b909-1c3e8d90f123
status: experimental
description: Detects SNMP GET requests for system serial numbers (sysSerialNumber) targeting OT subnets, often a precursor to deriving default credentials on ICS devices.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-160-02
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.discovery
  - attack.t1018
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 161
    Protocol|contains: 'udp'
  filter_noise:
    DestinationIpAddress|startswith:
      - '192.168.'
      - '10.'
      - '172.16.'
  condition: selection and not filter_noise
falsepositives:
  - Authorized network scanning tools
  - SNMP monitoring systems
level: medium
---
title: KACO Inverter Management Interface Access from Non-Admin Hosts
id: 9b5d3e21-6f78-5a23-c0a1-2d4f9e01a234
status: experimental
description: Detects inbound connections to KACO inverter management ports (typically 80/443/502) from endpoints outside the designated OT admin subnet.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-160-02
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 80
      - 443
      - 502
  selection_scope:
    DestinationIpAddress|cidr: '192.0.2.0/24' # REPLACE WITH YOUR ICS SUBNET
  filter_admin:
    SourceIpAddress|cidr: '198.51.100.0/24' # REPLACE WITH YOUR ADMIN SUBNET
  condition: selection_ports and selection_scope and not filter_admin
falsepositives:
  - Legitimate access from unauthorized laptop
level: high


**Microsoft Sentinel / Defender KQL Hunt:**

// Hunt for SNMP Serial Number queries to ICS Subnets
let OT_Subnets = dynamic(['10.20.0.0/16', '192.168.100.0/24']); // Define your OT ranges
DeviceNetworkEvents
| where DestinationPort == 161 // SNMP
| where ipv4_is_in_range(DestinationIPAddress, OT_Subnets)
| where RemotePort == 161
| project Timestamp, DeviceName, SourceIPAddress, DestinationIPAddress, InitiatingProcessFileName
| where InitiatingProcessFileName in~ ('snmpwalk.exe', 'snmpget.exe', 'python.exe', 'perl.exe') // Common tools for OID querying
| summarize count() by SourceIPAddress, DestinationIPAddress, bin(Timestamp, 5m)
| order by count_ desc


**Velociraptor VQL:**

-- Hunt for process execution of SNMP tools on Admin Workstations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'snmp' 
   OR Name =~ 'nmap' 
   OR Name =~ 'masscan'
   OR Exe =~ '\\Tools\\'


**Remediation Verification Script (Bash):**

#!/bin/bash

# Vulnerability Assessment Script for Siemens KACO Blueplanet Inverters
# Usage: ./check_kaco_devices.sh <subnet_cidr>

SUBNET=$1
KNOWN_VULN_PATTERNS="(blueplanet 100 NX3 M8|blueplanet 100 TL3 GEN2)"

if [ -z "$SUBNET" ]; then
  echo "Usage: $0 <CIDR_RANGE>"
  exit 1
fi

echo "[*] Scanning $SUBNET for KACO Inverters on port 80..."

# Using nmap to probe web server headers (requires nmap installed)
# We look for the 'Server' header which often reveals the device model
nmap -p 80 --open -oG - $SUBNET 2>/dev/null | grep "80/tcp" | awk '{print $2}' | while read ip; do
  echo "[+] Checking host: $ip"
  RESPONSE=$(curl -s -m 2 --connect-timeout 2 http://$ip | head -n 20)
  
  # Simple grep for device models in the HTML title or body
  if echo "$RESPONSE" | grep -qiE "blueplanet|kaco"; then
    echo "[!] KACO Device Detected at $ip"
    echo "    Response Snippet:"
    echo "$RESPONSE" | grep -iE "blueplanet|version" | head -n 3
    echo "    ACTION REQUIRED: Verify version against ICSA-26-160-02"
  fi
done

echo "[*] Scan complete. Please verify findings against the official advisory."