ICSA-26-293-01: HMS Networks PEAK-System PCAN Driver Flaws (CVE-2026-109576 + 5 More) — Windows Kernel Crash Detection and Remediation Guide

---
title: Windows Kernel Crash Referencing PEAK PCAN Driver Module
id: 3f7a2b91-6c4d-4e8a-9b1f-2d5c7a9e0f31
status: experimental
description: Detects Windows BugCheck (BSOD) events or WER crash reports where the faulting module is a PEAK-System PCAN kernel driver, indicating possible exploitation of CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, or CVE-2026-105960.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: windows
  service: system
detection:
  selection_provider:
    Provider_Name:
      - 'Microsoft-Windows-WER-SystemErrorReporting'
      - 'Microsoft-Windows-Kernel-Power'
      - 'BugCheck'
  selection_module:
    Message|contains:
      - 'pcan_usb.sys'
      - 'pcan_usbfd.sys'
      - 'pcan_pci.sys'
      - 'pcan_pcie.sys'
      - 'pcan_isa.sys'
      - 'pcan_dng.sys'
      - 'pcan.sys'
  condition: selection_provider and selection_module
falsepositives:
  - Genuine driver instability on heavily loaded CAN test benches; investigate crash dumps to confirm root cause
level: high
---
title: PEAK PCAN Kernel Driver File Dropped or Replaced
id: 8b2e4c15-7d3a-4f6b-a2c8-1e9d5f3b7a42
status: experimental
description: Detects creation or modification of PEAK-System PCAN kernel driver files in the Windows drivers directory. May indicate installation of a vulnerable driver version (<=5.1.2) or a bring-your-own-vulnerable-driver (BYOVD) staging attempt leveraging CVE-2026-109576 and related CVEs.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\System32\drivers\pcan_usb.sys'
      - '\System32\drivers\pcan_usbfd.sys'
      - '\System32\drivers\pcan_pci.sys'
      - '\System32\drivers\pcan_pcie.sys'
      - '\System32\drivers\pcan_isa.sys'
      - '\System32\drivers\pcan_dng.sys'
  filter_legit_installer:
    Image|endswith:
      - '\PCAN-Basic\Setup.exe'
      - '\PeakOemDrv.exe'
  condition: selection and not 1 of filter_legit_installer*
falsepositives:
  - Legitimate PEAK driver installation or update by engineering staff; correlate with change management tickets
level: medium
---
title: Vulnerable PCAN Driver Package Installation via PnPUtil or Installer
id: 5c1d8f37-2a6b-4e9d-b3f7-8a4c6e1d9b53
status: experimental
description: Detects driver package staging or installation referencing PEAK-System PCAN drivers through pnputil, dpinst, or the PEAK setup executable, which may introduce vulnerable driver versions (<=5.1.2.1151) onto the system.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.persistence
  - attack.t1547
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\pnputil.exe'
      - '\dpinst.exe'
      - '\PeakOemDrv.exe'
      - '\PeakCpl.exe'
  selection_cli:
    CommandLine|contains:
      - 'pcan'
      - 'peak-system'
      - 'peak system'
  condition: all of selection_*
falsepositives:
  - Scheduled driver deployment by engineering or IT; validate driver version post-install against 5.1.2.1151 baseline
level: medium

// Hunt: PEAK PCAN driver footprint, installation activity, and crash indicators (ICSA-26-293-01)
let PcanModules = dynamic(["pcan_usb.sys","pcan_usbfd.sys","pcan_pci.sys","pcan_pcie.sys","pcan_isa.sys","pcan_dng.sys","pcan.sys"]);
union isfuzzy=true
// 1. Driver files present on endpoints (vulnerable inventory)
(DeviceFileEvents
 | where FileName has_any (PcanModules)
 | where FolderPath has @"\System32\drivers"
 | summarize FilesSeen = make_set(FolderPath), LastSeen = max(Timestamp) by DeviceName, FileName
 | extend Signal = "PcanDriverFilePresent"),
// 2. Driver install/staging activity via pnputil/dpinst/PEAK setup
(DeviceProcessEvents
 | where FileName in~ ("pnputil.exe","dpinst.exe","PeakOemDrv.exe","PeakCpl.exe")
 | where ProcessCommandLine has_any ("pcan","peak")
 | project Signal = "DriverInstallAttempt", TimeGenerated = Timestamp, DeviceName,
           FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName),
// 3. Kernel crash / unexpected shutdown telemetry on hosts with PCAN drivers
(DeviceEvents
 | where ActionType == "UnexpectedShutdown" or AdditionalFields has "BugCheck"
 | project Signal = "KernelCrashTelemetry", TimeGenerated = Timestamp, DeviceName, ActionType, AdditionalFields),
// 4. Syslog-ingested OT jump hosts reporting BugCheck (CEF/syslog collectors)
(Syslog
 | where SyslogMessage has_any (PcanModules) and SyslogMessage has "bugcheck"
 | project Signal = "SyslogCrashRefPcan", TimeGenerated, HostName = Computer, SyslogMessage)
| sort by TimeGenerated desc

-- Hunt: Enumerate PEAK PCAN driver versions and associated crash dumps (ICSA-26-293-01)
LET drivers = SELECT FullPath, Size, Mtime,
       parse_pe(File=FullPath).FileVersion AS FileVersion
FROM glob(globs="C:/Windows/System32/drivers/pcan*.sys")

LET minidumps = SELECT FullPath AS DumpPath, Mtime AS DumpTime, Size AS DumpSize
FROM glob(globs="C:/Windows/Minidump/*.dmp")

SELECT "DriverFile" AS ArtifactType, FullPath, FileVersion, Mtime, Size,
       "" AS DumpPath, "" AS DumpTime
FROM drivers
WHERE FileVersion <= "5.1.2.1151" OR True
UNION ALL
SELECT "CrashDump" AS ArtifactType, "" AS FullPath, "" AS FileVersion,
       "" AS Mtime, 0 AS Size, DumpPath, format(format="%v", args=DumpTime) AS DumpTime
FROM minidumps

# ICSA-26-293-01 - PEAK PCAN driver inventory and vulnerability check
# Flags any installed PCAN driver <= 5.1.2.1151 as vulnerable
# Run as Administrator; safe for read-only inventory

$VulnerableBaseline = [version]"5.1.2.1151"
$DriverPath = "$env:SystemRoot\System32\drivers"
$Report = @()

# 1. Check on-disk PCAN driver binaries
$pcanDrivers = Get-ChildItem -Path $DriverPath -Filter "pcan*.sys" -ErrorAction SilentlyContinue

foreach ($drv in $pcanDrivers) {
    $ver = [version]($drv.VersionInfo.FileVersion -replace '[^0-9\.]', '' -replace '\.{2,}', '.')
    $status = if ($ver -le $VulnerableBaseline) { "VULNERABLE - patch required" } else { "Patched baseline met" }
    $Report += [pscustomobject]@{
        Host     = $env:COMPUTERNAME
        Driver   = $drv.Name
        Version  = $ver
        Status   = $status
        Modified = $drv.LastWriteTime
    }
}

# 2. Check installed PEAK setup package via registry
$peakInstall = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
               "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
               Where-Object { $_.DisplayName -match "PCAN|PEAK" } |
               Select-Object DisplayName, DisplayVersion, InstallDate

# 3. Check recent BugCheck events referencing PCAN modules (last 30 days)
$crashes = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
           Where-Object { $_.Message -match "pcan" } |
           Select-Object TimeCreated, Message

# Output
Write-Host "=== PCAN Driver Inventory for $env:COMPUTERNAME ===" -ForegroundColor Cyan
$Report | Format-Table -AutoSize
Write-Host "=== Installed PEAK Packages ===" -ForegroundColor Cyan
$peakInstall | Format-Table -AutoSize
Write-Host "=== PCAN-Related Kernel Crashes (30 days) ===" -ForegroundColor Cyan
if ($crashes) { $crashes | Format-List } else { Write-Host "None found." }

$vulnFound = $Report | Where-Object { $_.Status -match "VULNERABLE" }
if ($vulnFound) {
    Write-Warning "Vulnerable PCAN driver(s) detected. Download the updated Device Driver Setup from https://www.peak-system.com/ and deploy during the next maintenance window."
    exit 1
} else {
    Write-Host "No vulnerable PCAN drivers detected (or none installed)." -ForegroundColor Green
    exit 0
}