ICS Patch Tuesday: Schneider Electric, Siemens, AVEVA, and Rockwell Automation Advisories — Defender's Patching and Detection Guide

---
title: Engineering or HMI Software Spawning Unexpected Child Process
id: 8f2c4a1d-3b5e-4f7a-9c1d-2e6b8a0f4d7c
status: experimental
description: Detects ICS engineering or HMI software (Siemens, Schneider Electric, AVEVA, Rockwell) spawning shells or script interpreters, a common post-exploitation artifact when vulnerabilities in these applications are abused for code execution.
references:
  - https://www.securityweek.com/ics-patch-tuesday-schneider-electric-siemens-fix-critical-flaws/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\S7tgtopx.exe'           # Siemens TIA Portal
      - '\S7hspinx.exe'           # Siemens TIA Portal
      - '\ArchestrA.exe'          # AVEVA System Platform
      - '\aaLogger.exe'           # AVEVA
      - '\Studio5000.exe'         # Rockwell Studio 5000
      - '\FTViewSE.exe'           # Rockwell FactoryTalk View
      - '\SoMachine.exe'          # Schneider EcoStruxure Machine Expert
      - '\ControlExpert.exe'      # Schneider EcoStruxure Control Expert (Unity Pro)
      - '\UnityPro.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor installers and update mechanisms briefly spawning script interpreters during legitimate updates
level: high
---
title: Inbound Connection to OT Protocol Ports from Non-Engineering Host
id: 4b7e1c92-6a3d-4f8e-b2c5-9d1e7a3f0b6e
status: experimental
description: Detects network connections to well-known OT protocol ports (Modbus, S7comm, EtherNet/IP) initiated by processes outside expected engineering software. Exploitation of ICS vulnerabilities frequently culminates in unauthorized control traffic to PLCs and HMIs.
references:
  - https://www.securityweek.com/ics-patch-tuesday-schneider-electric-siemens-fix-critical-flaws/
  - https://attack.mitre.org/techniques/T0885/   # MITRE ATT&CK for ICS: Commonly Used Port
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.ics.t0885
  - attack.lateral_movement
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 102      # S7comm (Siemens)
      - 502      # Modbus/TCP (Schneider and others)
      - 44818    # EtherNet/IP (Rockwell)
      - 20000    # DNP3
      - 2222     # EtherNet/IP implicit messaging
  filter_known_engines:
    Image|endswith:
      - '\S7tgtopx.exe'
      - '\Studio5000.exe'
      - '\ControlExpert.exe'
      - '\UnityPro.exe'
      - '\SoMachine.exe'
      - '\RSLinxNG.exe'
  condition: selection_port and not filter_known_engines
falsepositives:
  - Legitimate OPC gateways, historians, and protocol converters — build a per-site allowlist of approved source hosts before enabling at high level
level: high

let KnownOTSources = dynamic(["ENGWS01", "HISTORIAN01", "OPCGW01"]);   // replace with your approved OT hosts
let OTProcesses = dynamic(["s7tgtopx.exe", "studio5000.exe", "controlexpert.exe", "unitypro.exe", "somachine.exe", "archestra.exe", "ftviewse.exe", "rslinxng.exe"]);
let InterpreterProcs = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe"]);
union isfuzzy=true
(DeviceProcessEvents
| where InitiatingProcessFileName has_any (OTProcesses)
  and FileName has_any (InterpreterProcs)
| extend Detection = "Engineering software spawned interpreter"
| project TimeGenerated, Detection, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName),
(DeviceNetworkEvents
| where RemotePort in (102, 502, 44818, 20000, 2222)
  and not (InitiatingProcessFileName has_any (OTProcesses))
  and not (DeviceName in~ (KnownOTSources))
| extend Detection = "Unexpected process connecting to OT protocol port"
| project TimeGenerated, Detection, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort)
| order by TimeGenerated desc

let OTSubnet = dynamic(["10.20.0.0/16", "172.30.0.0/16"]);   // replace with your OT/Purdue L2-L3 ranges
CommonSecurityLog
| where DestinationPort in (102, 502, 44818, 20000)
| where ipv4_is_in_range(DestinationIP, toscalar(OTSubnet[0])) or ipv4_is_in_range(DestinationIP, toscalar(OTSubnet[1]))
| where not (ipv4_is_in_range(SourceIP, toscalar(OTSubnet[0])) or ipv4_is_in_range(SourceIP, toscalar(OTSubnet[1])))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by LastSeen desc

-- Hunt for interpreter processes parented by ICS engineering/HMI software
-- and for unexpected listeners on OT protocol ports.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|certutil)\.exe'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE Exe =~ '(?i)(s7tgtopx|studio5000|controlexpert|unitypro|somachine|archestra|ftviewse|rslinxng)'
  )

-- Identify processes listening on OT protocol ports that are not known engineering software
SELECT Pid, Name, Path, Address, Port, Status
FROM netstat()
WHERE Port IN (102, 502, 44818, 20000, 2222)
  AND NOT Path =~ '(?i)(siemens|schneider|rockwell|aveva|wonderware)'

# ============================================================
# ICS Patch Tuesday Response — Inventory + Compensating Controls
# Run as Administrator on engineering workstations / HMI servers
# ============================================================

# --- Step 1: Inventory installed ICS vendor software and versions ---
$vendors = 'Siemens','Schneider Electric','AVEVA','Rockwell Automation','AVEVA Group','Wonderware'
$installed = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $_.Publisher -and ($vendors | ForEach-Object { $_ } | Where-Object { $Publisher = $_; $false }) -eq $null }

# Cleaner enumeration:
$icsSoftware = foreach ($hive in @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                                    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')) {
    Get-ItemProperty $hive -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -and ($vendors | Where-Object { $_.DisplayName -match $_ -or $_.Publisher -match $_ }) } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
}
$icsSoftware | Sort-Object Publisher, DisplayName | Format-Table -AutoSize
$icsSoftware | Export-Csv -Path "$env:TEMP\ICS_Software_Inventory_$(hostname).csv" -NoTypeInformation
Write-Host "[+] Inventory exported to $env:TEMP\ICS_Software_Inventory_$(hostname).csv — compare DisplayVersion against the vendor advisories." -ForegroundColor Green

# --- Step 2: Confirm recent hotfix installation state ---
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn | Format-Table -AutoSize

# --- Step 3: Compensating control — restrict OT protocol ports to approved engineering hosts ---
# Replace with your approved engineering workstation / historian IPs
$ApprovedOTSources = @('10.20.10.15','10.20.10.16')   # <-- EDIT BEFORE RUNNING

foreach ($rule in @(
    @{Name='OT-Restrict-Modbus-TCP502';    Port=502},
    @{Name='OT-Restrict-S7comm-TCP102';    Port=102},
    @{Name='OT-Restrict-EtherNetIP-44818'; Port=44818}
)) {
    if (-not (Get-NetFirewallRule -DisplayName $rule.Name -ErrorAction SilentlyContinue)) {
        New-NetFirewallRule -DisplayName $rule.Name -Direction Inbound -Protocol TCP `
            -LocalPort $rule.Port -RemoteAddress $ApprovedOTSources -Action Allow `
            -Profile Any -Description "Allow OT protocol only from approved engineering hosts (compensating control pending patching)" | Out-Null
        # Explicit block for all other sources on the same port
        New-NetFirewallRule -DisplayName "$($rule.Name)-BlockOthers" -Direction Inbound -Protocol TCP `
            -LocalPort $rule.Port -Action Block -Profile Any `
            -Description "Block all other inbound sources on OT port pending patch deployment" | Out-Null
        Write-Host "[+] Applied compensating firewall rules for TCP/$($rule.Port)" -ForegroundColor Green
    } else {
        Write-Host "[=] Rule $($rule.Name) already exists — skipping." -ForegroundColor Yellow
    }
}

# --- Step 4: Verify Windows Firewall is enforcing on all profiles ---
Get-NetFirewallProfile | Where-Object { $_.Enabled -eq $false } | ForEach-Object {
    Set-NetFirewallProfile -Name $_.Name -Enabled True
    Write-Host "[!] Firewall profile $($_.Name) was DISABLED — re-enabled. Investigate why." -ForegroundColor Red
}

Write-Host "`n[DONE] Review the inventory CSV against the current Schneider/Siemens/AVEVA/Rockwell advisories and schedule patching for any vulnerable versions." -ForegroundColor Cyan