ICS Patch Tuesday: Mitigating Vulnerabilities in Siemens, Schneider, and Phoenix Contact

---
title: Potential Code Execution via Siemens Industrial Software
id: a1b2c3d4-5678-90ab-cdef-123456789012
status: experimental
description: Detects Siemens engineering software (e.g., WinCC, TIA Portal) spawning suspicious child processes like cmd or powershell, indicating potential code execution.
references:
  - https://www.siemens.com/cert
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Siemens\'
      - '\WinCC\'
      - '\TIA Portal\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripts executed by engineers during maintenance.
level: high
---
title: Potential Exploitation of Schneider Electric Software
id: b2c3d4e5-6789-01ab-cdef-234567890123
status: experimental
description: Detects Schneider Electric EcoStruxure or Unity software spawning system shells or network tools, a common TTP in ICS attacks.
references:
  - https://www.se.com/ww/en/download/document/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Schneider Electric\'
      - '\Unity Pro\'
      - '\EcoStruxure\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\system32\reg.exe'
  condition: all of selection_*
falsepositives:
  - Valid software installation or configuration tasks.
level: high
---
title: Suspicious Child Process from Phoenix Contact Automation Suite
id: c3d4e5f6-7890-12bc-def3-345678901234
status: experimental
description: Detects PC WORX or related Phoenix Contact tools spawning unusual child processes indicative of exploitation.
references:
  - https://www.phoenixcontact.com/security
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Phoenix Contact\'
      - '\PC WORX\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  condition: all of selection_*
falsepositives:
  - Administrative automation scripts.
level: medium

// Hunt for suspicious parent-child relationships in OT environment
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has_any ("Siemens", "Schneider Electric", "Phoenix Contact")
| where ProcessVersionInfoCompanyName in ("Siemens AG", "Schneider Electric", "Phoenix Contact")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, CommandLine
| order by Timestamp desc

-- Hunt for OT vendor software spawning shells
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ 'wincc' 
   OR Parent.Name =~ 'unitypro'
   OR Parent.Name =~ 'pcworx'
   OR Name =~ 'cmd.exe' 
   OR Name =~ 'powershell.exe'

# ICS Patch Compliance Verifier
# Checks for file versions of common OT vendor binaries

$TargetPaths = @(
    "C:\Program Files (x86)\Siemens",
    "C:\Program Files\Siemens",
    "C:\Program Files (x86)\Schneider Electric",
    "C:\Program Files\Schneider Electric",
    "C:\Program Files (x86)\Phoenix Contact",
    "C:\Program Files\Phoenix Contact"
)

Write-Host "[*] Scanning for OT Vendor executables..." -ForegroundColor Cyan

foreach ($Path in $TargetPaths) {
    if (Test-Path $Path) {
        Write-Host "[+] Found directory: $Path" -ForegroundColor Green
        $Files = Get-ChildItem -Path $Path -Recurse -Include *.exe -ErrorAction SilentlyContinue | Select-Object -First 5
        foreach ($File in $Files) {
            $VersionInfo = $File.VersionInfo
            Write-Host "    - File: $($File.Name)"
            Write-Host "      Version: $($VersionInfo.FileVersion)"
            Write-Host "      Path: $($File.FullName)"
        }
    }
}

Write-Host "[*] Scan complete. Compare versions with vendor advisories." -ForegroundColor Cyan