Schneider Electric IGSS Vulnerability (ICSA-26-211-04): Detection and Hardening Guide

---
title: Schneider Electric IGSS Definition Module Spawning Shell
id: a1b2c3d4-2626-4e8a-a1b2-3f4a5b6c7d8e
status: experimental
description: Detects the IGSS Definition module (Def.exe) spawning cmd.exe, powershell.exe, or other shells. This behavior is highly anomalous for a design-time tool and indicates potential exploit activity.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-04
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\Def.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripting initiated by the operator (unlikely)
level: high
---
title: Schneider Electric IGSS Definition Module Unusual Network Connection
id: b2c3d4e5-2626-4e8a-b2c3-4a5b6c7d8e9f
status: experimental
description: Detects outbound network connections initiated by Def.exe. The definition module is a local design tool and should not initiate network connections on its own.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-04
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\Def.exe'
    Initiated: 'true'
  condition: selection
falsepositives:
  - Vendor software update checks or license verification (rare)
level: medium

// Hunt for vulnerable versions of Def.exe in the environment
DeviceFileEvents
| where FileName =~ "Def.exe"
| extend FileVersion = tostring(parse_(AdditionalFields).FileVersion)
| where FileVersion in~ ("18.0.0.26124", "18.0.0.26125") or FileVersion < "18.0.0.26124"
| project Timestamp, DeviceName, FolderPath, FileVersion, SHA256
| order by Timestamp desc

// Hunt for suspicious process creation by Def.exe
DeviceProcessEvents
| where InitiatingProcessFileName =~ "Def.exe"
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessVersionInfoCompanyName, FileName, ProcessCommandLine, ActionType
| order by Timestamp desc

-- Hunt for vulnerable IGSS Definition Module versions
SELECT FullPath, Size, Mtime, parse_string(FileVersion=Version.String) AS FileVersion
FROM glob(globs="C:/Program Files*/**/Def.exe")
WHERE FileVersion =~ "18.0.0.26124" 
   OR FileVersion =~ "18.0.0.26125"
   OR parse_version(FileVersion) < parse_version("18.0.0.26124")

# Audit Script for Schneider Electric IGSS Definition Module (ICSA-26-211-04)
# Identifies vulnerable versions of Def.exe

$VulnerableVersions = @("18.0.0.26124", "18.0.0.26125")
$BasePaths = @("C:\Program Files", "C:\Program Files (x86)")
$FoundVulnerable = $false

foreach ($Path in $BasePaths) {
    if (Test-Path $Path) {
        $Files = Get-ChildItem -Path $Path -Filter "Def.exe" -Recurse -ErrorAction SilentlyContinue
        foreach ($File in $Files) {
            $VersionInfo = $File.VersionInfo
            $FileVersion = $VersionInfo.FileVersion
            
            # Check if version is in the specific vulnerable list or older than the fixed version
            if ($VulnerableVersions -contains $FileVersion -or $FileVersion -lt "18.0.0.26126") {
                Write-Host "[ALERT] Vulnerable IGSS Definition Module found: $($File.FullName)" -ForegroundColor Red
                Write-Host "Version: $FileVersion" -ForegroundColor Red
                $FoundVulnerable = $true
            }
        }
    }
}

if (-not $FoundVulnerable) {
    Write-Host "No vulnerable IGSS Definition modules found on this host." -ForegroundColor Green
}