ICSA-26-281-02: Critical openPDC & openHistorian Flaws (CVSS 9.8) — Detection and Remediation Guide for Energy-Sector Defenders

---
title: openPDC or openHistorian Process Spawning Shell or Script Interpreter
id: 3f8a2c91-7b4e-4d6a-9c21-8e5f0a1b2c3d
status: experimental
description: Detects openPDC/openHistorian service processes spawning command shells or script interpreters, consistent with post-exploitation following deserialization or unsafe reflection RCE (ICSA-26-281-02).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\openPDC.exe'
      - '\openPDCConsole.exe'
      - '\openHistorian.exe'
      - '\openHistorianConsole.exe'
      - '\HistorianAdapters.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate vendor diagnostic scripts invoked by administrators; verify with change records
level: critical
---
title: openPDC or openHistorian SSRF to Cloud Metadata or Internal Infrastructure
id: 6d1e4a72-9c83-4f5b-b7e2-2a9d0c4e5f6a
status: experimental
description: Detects outbound connections from openPDC/openHistorian processes to cloud instance metadata endpoints or link-local ranges, indicative of SSRF abuse per ICSA-26-281-02.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\openPDC.exe'
      - '\openPDCConsole.exe'
      - '\openHistorian.exe'
      - '\openHistorianConsole.exe'
  selection_metadata:
    DestinationIp:
      - '169.254.169.254'
      - '169.254.170.2'
      - '100.100.100.200'
      - '192.0.0.192'
  condition: selection_image and selection_metadata
falsepositives:
  - None expected; synchrophasor services have no legitimate reason to query cloud metadata endpoints
level: critical
---
title: Unauthenticated-Style Access to openPDC or openHistorian Management Interfaces from Unexpected Hosts
id: 9b2c5d83-1e6f-4a7c-c8d3-5f1e2a3b4c5d
status: experimental
description: Detects inbound network connections to openPDC/openHistorian management web interfaces originating from hosts outside expected OT/EMS segments, consistent with exploitation of missing authentication for critical functions (ICSA-26-281-02). Tune AllowedSources to your environment.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t0883
logsource:
  category: firewall
  product: windows
detection:
  selection:
    dst_port:
      - 8180
      - 8280
      - 8888
      - 6165
  filter_allowed:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection and not filter_allowed
falsepositives:
  - Internet-routable deployments (strongly discouraged); scanner infrastructure; tune source CIDRs to approved EMS/SCADA management segments
level: high

// Hunt 1: openPDC/openHistorian service spawning shells or reaching suspicious destinations
let ServiceProcs = dynamic(["openPDC.exe","openPDCConsole.exe","openHistorian.exe","openHistorianConsole.exe","HistorianAdapters.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe"]);
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (ServiceProcs)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, ReportId;
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (ServiceProcs)
| where RemoteIP in ("169.254.169.254","169.254.170.2","100.100.100.200")
   or (RemoteUrl has_any ("metadata.google.internal"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, ReportId;
union ProcHits, NetHits
| sort by TimeGenerated desc;

// Hunt 2: External/unexpected sources hitting openPDC/openHistorian management listeners (CEF/Syslog firewall ingestion)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (8180, 8280, 8888, 6165)
| where DeviceAction in ("allow","allowed","accept","Accept") or isempty(DeviceAction)
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, DestinationIP, DestinationPort, DeviceVendor
| sort by ConnectionCount desc;

// Hunt 3: Docker-host syslog for openPDC container shell execution (possible container breakout or post-exploit triage)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("dockerd","containerd")
| where SyslogMessage has_any ("openpdc","openhistorian")
| where SyslogMessage has_any ("exec","/bin/sh","/bin/bash","sh -c")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

-- Scope openPDC/openHistorian exposure: processes, versions on disk, and network sockets
-- ICSA-26-281-02 (CVE-2026-104629 et al.)

LET procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)openpdc|openhistorian|historianadapters'

LET sockets = SELECT Pid, Name, Family, Type, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Name =~ '(?i)openpdc|openhistorian'

LET binaries = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Program Files/openPDC/**/*.exe','C:/Program Files/openHistorian/**/*.exe','C:/Program Files (x86)/openPDC/**/*.exe'])
WHERE FullPath =~ '(?i)openpdc|openhistorian'

SELECT * FROM procs
UNION ALL
SELECT * FROM sockets

-- Verify openPDC Docker image version on Linux/container hosts
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE CommandLine =~ '(?i)openpdc'
   OR CommandLine =~ '(?i)openhistorian'

# openPDC / openHistorian patch verification and exposure audit (Windows hosts)
# Run elevated on each host running openPDC or openHistorian services

# 1. Enumerate installed openPDC/openHistorian services and binary versions
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match 'openPDC|openHistorian|HistorianAdapters' } |
  ForEach-Object {
    $exe = ($_.PathName -replace '"','') -split ' ' | Select-Object -First 1
    $ver = if (Test-Path $exe) { (Get-Item $exe).VersionInfo.ProductVersion } else { 'NOT FOUND' }
    [PSCustomObject]@{
      Service   = $_.Name
      State     = $_.State
      StartName = $_.StartName
      Binary    = $exe
      Version   = $ver
      Compliant = ($ver -ge '2.9.482' -and $_.Name -match 'PDC') -or ($ver -ge '2.8.585' -and $_.Name -match 'Historian')
    }
  } | Format-Table -AutoSize

# 2. Identify listeners bound to all interfaces (0.0.0.0) on management/historian ports
Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalPort -in 8180,8280,8888,6165 -and $_.LocalAddress -in '0.0.0.0','::' } |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Format-Table -AutoSize

# 3. Audit child processes of openPDC/openHistorian for signs of prior exploitation
Get-CimInstance Win32_Process |
  Where-Object { $_.Name -match 'cmd|powershell|pwsh|mshta|rundll32' } |
  ForEach-Object {
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
    if ($parent.Name -match 'openPDC|openHistorian') {
      [PSCustomObject]@{ Time=$_.CreationDate; Child=$_.Name; CmdLine=$_.CommandLine; Parent=$parent.Name }
    }
  } | Format-List

# 4. Check for cloud metadata access in Windows Firewall / DNS cache (SSRF indicator)
Get-NetConnectionProfile | Out-Null
Resolve-DnsName -Name 'metadata.google.internal' -ErrorAction SilentlyContinue

#!/usr/bin/env bash
# openPDC Docker deployment: version verification and hardening (Linux hosts)
# ICSA-26-281-02 — upgrade to gridprotectionalliance/openpdc:2.9.482 or later

set -euo pipefail

# 1. Report currently running openPDC container image tags
echo "=== Running openPDC containers ==="
docker ps --filter "ancestor=gridprotectionalliance/openpdc" --format '{{.Names}} {{.Image}} {{.Status}}'
docker ps -a --format '{{.Names}} {{.Image}}' | grep -iE 'openpdc|openhistorian' || echo "No matching containers found"

# 2. Pull the patched image and verify tag
echo "=== Pulling patched image ==="
docker pull gridprotectionalliance/openpdc:latest
docker images gridprotectionalliance/openpdc --format '{{.Tag}} {{.CreatedAt}}'

# 3. Audit published ports — management interfaces must NOT be bound to 0.0.0.0
echo "=== Published port audit (flag any 0.0.0.0 bindings on mgmt ports) ==="
docker ps --format '{{.Names}} {{.Ports}}' | grep -iE 'openpdc|openhistorian'

# 4. Check for shell execution inside containers (post-exploitation indicator)
echo "=== Container exec audit ==="
for c in $(docker ps --format '{{.Names}}' | grep -iE 'openpdc|openhistorian'); do
  echo "--- $c ---"
  docker logs "$c" 2>&1 | grep -iE 'exec|/bin/sh|/bin/bash' | tail -20 || true
done

# 5. Verify no outbound connections to metadata endpoints from containers
echo "=== SSRF / metadata egress check (conntrack) ==="
conntrack -L 2>/dev/null | grep -E '169.254.169.254|169.254.170.2' || echo "No metadata connections observed"