Siemens Software Center DLL Side-Loading Flaw Exploited by Romulus ClickFix Campaign — Detection and Remediation Guide

---
title: ClickFix Clipboard-Style Command Execution via Run Dialog
description: Detects suspicious commands launched through the Windows Run dialog (explorer.exe as parent spawning script interpreters or download cradles), consistent with ClickFix social engineering lures used in the Romulus campaign against Siemens Software Center users.
references:
  - https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
id: 3f8a2c91-7b4d-4e6a-9c1f-2d5e8a0b7c3d
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\rundll32.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'iwr '
      - 'irm '
      - 'Invoke-Expression'
      - 'IEX'
      - 'DownloadString'
      - 'mshta http'
      - 'certutil'
      - '-enc '
      - '-e '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Rare; legitimate software installs from the Run dialog with remote URLs are uncommon in enterprise environments
level: high
---
title: Suspicious DLL Written to Siemens Software Center Directory
description: Detects creation of DLL files in Siemens Software Center installation paths by processes other than the Siemens installer/updater, indicating potential DLL side-loading staging used by the Romulus campaign.
references:
  - https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/
  - https://attack.mitre.org/techniques/T1574.002/
author: Security Arsenal
id: 9b1d4e62-5a3f-4c8d-b2e7-6f0a1c9d4e8b
status: experimental
date: 2026/04/06
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1574.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Siemens\SoftwareCenter\'
      - '\Siemens\Siemens Software Center\'
      - '\Program Files\Siemens\'
      - '\Program Files (x86)\Siemens\'
  selection_ext:
    TargetFilename|endswith: '.dll'
  filter_legit:
    Image|contains:
      - '\Siemens\'
      - '\msiexec.exe'
      - '\TiWorker.exe'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Legitimate Siemens updates (filtered); third-party plugins installed by engineers
level: high
---
title: Siemens Software Center Process Loading Unsigned or Unsigned-Path Module
description: Detects Siemens Software Center executables loading DLLs from user-writable or anomalous locations (AppData, Temp, Public, user profile), a hallmark of DLL side-loading into a signed binary.
references:
  - https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/
  - https://attack.mitre.org/techniques/T1574.002/
author: Security Arsenal
id: 4c7e9f13-2d8b-4a5e-8f6c-1b3d7a9e0c52
status: experimental
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\Siemens\'
  selection_dll:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\Users\'
      - '\ProgramData\'
  filter_siemens_signed:
    Signed: 'true'
    Signature|contains: 'Siemens'
  condition: selection_image and selection_dll and not filter_siemens_signed
falsepositives:
  - Developer/test builds of Siemens components; verify signer before escalating
level: high

// Hunt: ClickFix-style execution + Siemens Software Center DLL staging
// Part 1: User-driven execution consistent with ClickFix lures (Run dialog / explorer parent)
let ClickFix = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","cmd.exe","curl.exe","rundll32.exe")
| where ProcessCommandLine has_any ("http://","https://","iwr","irm","IEX","Invoke-Expression","DownloadString","certutil","-enc")
| project ClickFixTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, ReportId;
// Part 2: DLL writes into Siemens Software Center paths by non-Siemens processes
let DllStaging = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has "\\Siemens\\" and FileName endswith ".dll"
| where InitiatingProcessFolderPath !has "\\Siemens\\"
   and InitiatingProcessFileName !in~ ("msiexec.exe","TiWorker.exe","TrustedInstaller.exe")
| project DllWriteTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256;
// Correlate hosts showing both behaviors
ClickFix
| join kind=inner DllStaging on DeviceName
| project DeviceName, AccountName, ClickFixTime, ProcessCommandLine, DllWriteTime, DllPath=FolderPath, FileName, InitiatingProcessFileName
| order by DeviceName asc;

-- Hunt for unsigned/recently modified DLLs in Siemens Software Center paths
-- and suspicious child processes of Siemens executables (side-load execution)
SELECT * FROM foreach(
  row={
    SELECT FullPath, Mtime, Size
    FROM glob(globs=[
      'C:/Program Files/Siemens/**/*.dll',
      'C:/Program Files (x86)/Siemens/**/*.dll',
      'C:/ProgramData/Siemens/**/*.dll'
    ])
    WHERE Mtime > now() - 1209600  -- modified in last 14 days
  },
  query={
    SELECT FullPath AS RecentDll, Mtime AS Modified,
           Pid, Name AS ProcessName, Exe, CommandLine, Username
    FROM pslist()
    WHERE Exe =~ '(?i)Siemens'
       OR CommandLine =~ '(?i)Siemens.*SoftwareCenter'
  })

# Siemens Software Center DLL Side-Loading — Verification & Hardening Script
# Run elevated on engineering workstations. Reviews Siemens install paths for
# unsigned or recently modified DLLs and checks ClickFix execution artifacts.

$ErrorActionPreference = 'SilentlyContinue'
$lookback = (Get-Date).AddDays(-14)
$siemensPaths = @(
    "$env:ProgramFiles\Siemens",
    "${env:ProgramFiles(x86)}\Siemens",
    "$env:ProgramData\Siemens"
) | Where-Object { Test-Path $_ }

if (-not $siemensPaths) {
    Write-Host "[+] No Siemens installation directories found on this host." -ForegroundColor Green
} else {
    Write-Host "[*] Scanning Siemens paths for unsigned or recently modified DLLs..." -ForegroundColor Cyan
    $suspicious = foreach ($path in $siemensPaths) {
        Get-ChildItem -Path $path -Recurse -Filter *.dll | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            $isSiemensSigned = ($sig.Status -eq 'Valid') -and ($sig.SignerCertificate.Subject -match 'Siemens')
            if (-not $isSiemensSigned -or $_.LastWriteTime -gt $lookback) {
                [PSCustomObject]@{
                    Path          = $_.FullName
                    LastWriteTime = $_.LastWriteTime
                    SigStatus     = $sig.Status
                    Signer        = $sig.SignerCertificate.Subject
                }
            }
        }
    }
    if ($suspicious) {
        Write-Host "[!] SUSPICIOUS DLLs found — investigate immediately:" -ForegroundColor Red
        $suspicious | Format-Table -AutoSize
        $suspicious | Export-Csv "$env:TEMP\siemens_suspicious_dlls.csv" -NoTypeInformation
    } else {
        Write-Host "[+] All Siemens DLLs are validly signed by Siemens and unmodified in last 14 days." -ForegroundColor Green
    }
}

# Check for ClickFix-style execution: Run dialog (RunMRU) containing URLs or script interpreters
Write-Host "[*] Checking Run dialog history (RunMRU) for ClickFix indicators..." -ForegroundColor Cyan
Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' |
  ForEach-Object {
    $_.Property | ForEach-Object {
        $val = (Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name $_).$_
        if ($val -match 'http|iwr|irm|mshta|powershell|certutil|iex') {
            Write-Host "[!] ClickFix indicator in RunMRU: $val" -ForegroundColor Red
        }
    }
  }

# Confirm installed Siemens Software Center version against the patched release
Write-Host "[*] Installed Siemens Software Center version(s):" -ForegroundColor Cyan
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match 'Siemens Software Center' } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize
Write-Host "[!] Verify DisplayVersion against the fixed version in the Siemens ProductCERT advisory." -ForegroundColor Yellow