ZionSiphon ICS Malware: Detection and Hardening Guide for Water & Desalination Infrastructure

---
title: ZionSiphon SCADA Process Side-Loading
id: 8a4c2d10-9e1a-4f5b-8b3c-1d2e3f4a5b6c
status: experimental
description: Detects ZionSiphon DLL side-loading technique where a malicious DLL is loaded by a legitimate HMI process.
references:
  - https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.persistence
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|contains:
      - 'HmiView.exe'
      - 'scada.exe'
      - 'runtime.exe'
    ImageLoaded|contains:
      - 'ZionCore.dll'
      - 'C:\Windows\Temp\user.dll'
  condition: selection
falsepositives:
  - Legitimate plugin loading by trusted vendors (verify signature)
level: critical
---
title: ZionSiphon C2 Traffic Pattern
id: 1b5d3e21-0f2b-4c6d-9e7f-2a3b4c5d6e7f
status: experimental
description: Detects network connections characteristic of ZionSiphon C2 beacons to external infrastructure.
references:
  - https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: 'true'
    UserAgent|contains:
      - 'ZionUpdate/1.0'
      - 'Mozilla/5.0 (compatible; WinSCADA/4.2)'
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Rare; legitimate HMI software usually connects to internal historians only.
level: high
---
title: Suspicious Service Installation ZionSiphon
id: 2c6e4f32-1a3c-5d7e-0f8a-3b4c5d6e7f8a
status: experimental
description: Detects the creation of a persistence service used by ZionSiphon masquerading as a protocol driver.
references:
  - https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sc create'
      - 'New-Service'
    CommandLine|contains:
      - 'ZionProtocolDriver'
      - 'ModbusGateSvc'
  condition: selection
falsepositives:
  - Administrator installing legitimate protocol drivers
level: high

// Hunt for ZionSiphon Indicators of Compromise
let SuspiciousServices = dynamic(["ZionProtocolDriver", "ModbusGateSvc", "ZionSvc"]);
let HMIProcesses = dynamic(["HmiView.exe", "scada.exe", "runtime.exe", "wincc"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
// Detect Service Creation
| where (ProcessVersionInfoOriginalFileName =~ "sc.exe" or FileName =~ "powershell.exe") and
    (ProcessCommandLine has "sc create" or ProcessCommandLine has "New-Service") and
    ProcessCommandLine has_any(SuspiciousServices)
| union (
    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "cmd.exe", "cmd")
    | where InitiatingProcessFileName has_any(HMIProcesses)
)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for ZionSiphon persistence and file artifacts
SELECT 
  OSPath,
  Size,
  Mtime,
  Mode,
  Data.Description as ServiceDescription,
  Data.ImagePath as ServicePath
FROM glob(globs="C:\\Windows\\System32\\drivers\\Zion*")
LEFT JOIN 
  SELECT Description, ImagePath 
  FROM registry_globs(globs="HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Zion*")
WHERE Mtime > ago(-7d)
  OR ServicePath =~ "*.dll"

# ZionSiphon Remediation Script
# Run as Administrator

Write-Host "[+] Starting ZionSiphon Remediation Check..." -ForegroundColor Cyan

$MaliciousServices = @("ZionProtocolDriver", "ModbusGateSvc", "ZionSvc")
$MaliciousPaths = @("C:\Windows\System32\ZionCore.dll", "C:\Windows\System32\drivers\ZionDrv.sys")

foreach ($ServiceName in $MaliciousServices) {
    $svc = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
    if ($svc) {
        Write-Host "[!] Malicious service found: $ServiceName" -ForegroundColor Red
        Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
        # Delete service
        sc.exe delete $ServiceName
        Write-Host "[+] Service $ServiceName removed." -ForegroundColor Green
    }
}

foreach ($Path in $MaliciousPaths) {
    if (Test-Path $Path) {
        Write-Host "[!] Malicious file found: $Path" -ForegroundColor Red
        Remove-Item -Path $Path -Force
        Write-Host "[+] File $Path deleted." -ForegroundColor Green
    }
}

Write-Host "[+] Remediation Complete. Please perform a full AV scan." -ForegroundColor Cyan