Simcenter Femap Datakit RCE: Detecting IPT File Exploitation (Versions < 2512.0003)

---
title: Simcenter Femap Spawning Windows Shell
id: 8b8e9d12-4c3a-4f5b-9e1d-2f3c4d5e6f7a
status: experimental
description: Detects Simcenter Femap spawning cmd.exe or powershell.exe, indicative of successful RCE or macro execution.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05
author: Security Arsenal
date: 2025/04/26
tags:
  - attack.execution
  - attack.t1204
  - cve.2025.26134
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\femap.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate engineering automation scripts (rare)
level: high
---
title: Simcenter Femap Spawning Scripting Hosts
id: 9c9f0e23-5d4b-5g6c-0f2e-3g4d5e6f7g8b
status: experimental
description: Detects Simcenter Femap spawning cscript.exe or wscript.exe, often used for secondary payloads.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05
author: Security Arsenal
date: 2025/04/26
tags:
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\femap.exe'
  selection_child:
    Image|endswith:
      - '\cscript.exe'
      - '\wscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate automation workflows
level: medium

// Hunt for suspicious child processes spawned by Simcenter Femap
DeviceProcessEvents
| where InitiatingProcessFileName =~ "femap.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for abnormal child processes of Simcenter Femap
SELECT Parent.Name AS ParentProcess, Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Parent.Name =~ "femap.exe"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe")

# Check Simcenter Femap Version and Remediation Status
$FixedVersion = [version]"2512.0003"
$VulnerableFound = $false

# Common installation paths for Simcenter Femap
$Paths = @(
    "C:\Program Files\Siemens\Simcenter Femap\",
    "C:\Program Files (x86)\Siemens\Simcenter Femap\"
)

Write-Host "[+] Scanning for Simcenter Femap installations..." -ForegroundColor Cyan

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        $FemapExe = Get-ChildItem -Path $Path -Filter "femap.exe" -Recurse -ErrorAction SilentlyContinue
        
        if ($FemapExe) {
            foreach ($Exe in $FemapExe) {
                try {
                    $VersionInfo = $Exe.VersionInfo.FileVersion
                    # Normalize version string for comparison if necessary (e.g. 202x.x) 
                    # Note: Siemens Femap versions often map format 202x.x to internal build numbers.
                    # This script checks against the specific fixed version string mentioned in advisory.
                    
                    Write-Host "    Found: $($Exe.FullName)"
                    Write-Host "    Version: $VersionInfo" -ForegroundColor Yellow

                    # Logic: If we cannot parse strictly, alert for manual verification if < 2512.0003
                    # Assuming standard version comparison logic applies to detected version string
                    if ($VersionInfo -lt $FixedVersion.ToString()) {
                        Write-Host "    [!] VULNERABLE: Version is below 2512.0003." -ForegroundColor Red
                        $VulnerableFound = $true
                    } else {
                        Write-Host "    [OK] Version meets patch requirement." -ForegroundColor Green
                    }
                }
                catch {
                    Write-Host "    [ERROR] Could not read version info for $($Exe.FullName)" -ForegroundColor Red
                }
            }
        }
    }
}

if (-not $VulnerableFound) {
    Write-Host "[+] No vulnerable versions detected in standard paths." -ForegroundColor Green
} else {
    Write-Host "[!] ACTION REQUIRED: Update vulnerable instances to version 2512.0003 or newer." -ForegroundColor Red
}