Siemens IAM Client Unquoted Search Path Vulnerability: Detection and Hardening

---
title: Potential Reconnaissance for Unquoted Service Paths
id: 8a2d3f14-1c4e-4b5f-9a0d-6e7f8a9b0c1d
status: experimental
description: Detects usage of WMIC to identify services with unquoted paths, a common precursor to exploiting this vulnerability.
references:
  - https://attack.mitre.org/techniques/T1007/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1007
  - attack.t1012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'service'
    CommandLine|contains|all:
      - 'get '
      - 'pathname'
      - 'displayname'
  filter_legit_admin:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'startmode'
      - 'state'
  condition: selection and not filter_legit_admin
falsepositives:
  - System administration inventory scripts
level: medium
---
title: Suspicious Process Execution from Root Drive
id: 9b3e4g25-2d5f-5c6g-0b1e-7f8g9a0c1d2e
status: experimental
description: Detects execution of binaries from the root of a drive (e.g. C:\Program.exe) which strongly suggests unquoted path exploitation.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|startswith:
      - 'C:\\Program.exe'
      - 'C:\\Files.exe'
      - 'C:\\Common.exe'
      - 'C:\\Windows\\System32\\Program.exe'
  condition: selection
falsepositives:
  - Legitimate software accidentally installed to root (rare)
level: high

// Hunt for vulnerable Siemens product versions
DeviceRegistryEvents
| where RegistryKey contains "Siemens"
| where RegistryKey contains "COMOS" 
   or RegistryKey contains "Simcenter" 
   or RegistryKey contains "Designcenter"
| where RegistryValueName == "DisplayVersion" 
   or RegistryValueName == "Version"
| project DeviceName, RegistryKey, RegistryValueName, RegistryValueData, Timestamp
// Add specific logic to compare versions against thresholds (e.g., < 10.6.1)
| where RegistryValueData has "10.4.5" or RegistryValueData has "10.6" or RegistryValueData has "2512" or RegistryValueData has "2506"
| order by Timestamp desc

-- Hunt for unquoted service paths related to Siemens IAM
SELECT Name, DisplayName, PathName, StartMode, State
FROM wmi(query="SELECT * FROM Win32_Service")
WHERE PathName =~ "Siemens"
   OR Name =~ "IAM"
   OR DisplayName =~ "IAM"
-- Simple heuristic: Path contains space but does not start with quote
   AND PathName =~ " " 
   AND NOT substring(PathName, 0, 1) = '"'

# Audit Siemens IAM Client for Unquoted Paths and Version Status
Write-Host "[+] Starting Siemens IAM Client Audit..." -ForegroundColor Cyan

# 1. Check for Unquoted Service Paths (High Risk)
Write-Host "\n[*] Checking for unquoted service paths in Siemens/IAM services..." -ForegroundColor Yellow
$services = Get-WmiObject Win32_Service | Where-Object { 
    $_.Name -like "*Siemens*" -or 
    $_.Name -like "*IAM*" -or 
    $_.PathName -like "*Siemens*" -or 
    $_.PathName -like "*COMOS*" -or 
    $_.PathName -like "*Simcenter*" 
}

$vulnerableServices = @()
foreach ($svc in $services) {
    $path = $svc.PathName
    if ($path -match ' ' -and $path -notmatch '^"') {
        Write-Host "[!] VULNERABLE SERVICE FOUND:" $svc.Name -ForegroundColor Red
        Write-Host "    Path: $path"
        $vulnerableServices += $svc.Name
    }
}

if ($vulnerableServices.Count -eq 0) {
    Write-Host "[+] No unquoted paths found in Siemens/IAM services." -ForegroundColor Green
}

# 2. Check Registry for Vulnerable Versions
Write-Host "\n[*] Checking registry for vulnerable product versions..." -ForegroundColor Yellow
$paths = @(
    "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$products = Get-ItemProperty $paths -ErrorAction SilentlyContinue | 
    Where-Object { 
        $_.DisplayName -like "*COMOS*" -or 
        $_.DisplayName -like "*Simcenter*" -or 
        $_.DisplayName -like "*Designcenter*"
    }

foreach ($prod in $products) {
    $name = $prod.DisplayName
    $ver = $prod.DisplayVersion
    # Basic logic to flag versions mentioned in advisory (simplified for audit)
    if ($ver -lt "10.4.5.0.2" -and $name -like "*COMOS 10.4.5*") {
        Write-Host "[!] OUTDATED: $name ($ver)" -ForegroundColor Red
    }
    elseif ($ver -lt "10.6.1" -and $name -like "*COMOS 10.6*") {
        Write-Host "[!] OUTDATED: $name ($ver)" -ForegroundColor Red
    }
    elseif ($ver -lt "2512.7000" -and ($name -like "*Simcenter 3D*" -or $name -like "*Designcenter NX*")) {
        Write-Host "[!] OUTDATED: $name ($ver)" -ForegroundColor Red
    }
    else {
        Write-Host "[+] OK: $name ($ver)" -ForegroundColor Green
    }
}
Write-Host "\n[*] Audit complete." -ForegroundColor Cyan

Update the affected software to the latest fixed versions or newer: