Siemens Software Center CVE-2026-110936 (Romulus ClickFix DLL side-loading)

// HUNT: Siemens Software Center launched by msiexec from AppData\Local\Programs (CVE-2026-110936 carrier)
// MITRE: T1574.002, T1218.007, T1204.002
// CONF: high  FP: medium  COST: low | REQUIRES: process creation with parent and image path
// TUNING: exclude ComputerName values of a sanctioned per-user rollout and the packaging UserName; confirm FileVersion is 4.0.9.8 or later before closing a hit.
// NOTE: the binary is genuine and signed. Never hash-match or block it; the signal is the path plus the msiexec parent.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^SiemensSoftwareCenter(\.exe)?$/i
| ImageFileName=/\\AppData\\Local\\Programs\\/i
| ParentBaseFileName=/^msiexec(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path, src.process.name

// HUNT: Siemens Software Center launched by msiexec from AppData\Local\Programs (CVE-2026-110936 carrier)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1218.007, T1204.002
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the carrier by name, the per-user Programs path, and msiexec as the creator. On a Process Creation event the created process is tgt.process.* and its creator is src.process.*, so msiexec is matched on src.process.name.
// REQUIRES: SentinelOne process-creation telemetry with creator and image path
// TUNING: Exclude hosts of a sanctioned per-user rollout and the packaging account; confirm the file version is 4.0.9.8 or later before closing a hit. The binary is genuine and signed, so never hash-match or block it.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('SiemensSoftwareCenter.exe', 'SiemensSoftwareCenter') tgt.process.image.path contains '\\AppData\\Local\\Programs\\' src.process.name in:anycase ('msiexec.exe', 'msiexec')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: Siemens Software Center launched by msiexec from AppData\Local\Programs (CVE-2026-110936 carrier)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1218.007, T1204.002
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the carrier by name, the per-user Programs path, and msiexec as the creator. The created process is FileName and its creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude devices of a sanctioned per-user rollout and the packaging account; confirm the file version is 4.0.9.8 or later before closing a hit. The binary is genuine and signed, so never hash-match or block it.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("SiemensSoftwareCenter.exe", "SiemensSoftwareCenter")
| where FolderPath contains "\\AppData\\Local\\Programs\\"
| where InitiatingProcessFileName in~ ("msiexec.exe", "msiexec")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Siemens Software Center per-user path baseline (any parent)
// MITRE: T1574.002
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent and image path
// TUNING: drop ParentBaseFileName values you see on sanctioned installs (for example your software-deployment agent); keep rows whose host never had Siemens software provisioned.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^SiemensSoftwareCenter(\.exe)?$/i
| ImageFileName=/\\AppData\\Local\\Programs\\/i
| groupBy([ComputerName, UserName, ParentBaseFileName, ImageFileName], function=[count(as=Launches), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([SHA256HashData])], limit=1000)
| sort(Launches, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path, endpoint.name, src.process.name

// HUNT: Siemens Software Center per-user path baseline (any parent)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping as the CQL baseline. The CQL collects the hashes into a list per group; here the hash is a group key, so a group with two hashes becomes two rows.
// REQUIRES: SentinelOne process-creation telemetry with creator and image path
// TUNING: Drop creator names you see on sanctioned installs, for example your software-deployment agent; keep rows whose host never had Siemens software provisioned.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch with no hash populated still groups, with an empty hash column.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('SiemensSoftwareCenter.exe', 'SiemensSoftwareCenter') tgt.process.image.path contains '\\AppData\\Local\\Programs\\'
| group launches=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, src.process.user, src.process.name, tgt.process.image.path, tgt.process.image.sha256
| sort -launches
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName, DeviceName, AccountName
| take 5

// HUNT: Siemens Software Center per-user path baseline (any parent)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping as the CQL baseline, with the creator as InitiatingProcessFileName. Hashes are collected into a set per group as in the CQL.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Drop creator names you see on sanctioned installs, for example your software-deployment agent; keep rows whose device never had Siemens software provisioned.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: SHA256 is not collected because it is often unpopulated; the set holds SHA1 values.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("SiemensSoftwareCenter.exe", "SiemensSoftwareCenter")
| where FolderPath contains "\\AppData\\Local\\Programs\\"
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Sha1s = make_set(SHA1) by DeviceName, AccountName, InitiatingProcessFileName, FolderPath
| sort by Launches desc
| take 200

// HUNT: msiexec running AllMyBasic.msi (out-of-channel Romulus bundle)
// MITRE: T1218.007, T1204.002
// CONF: high  FP: low  COST: low | REQUIRES: process creation with command line
// NOTE: filename-only signal, so an attacker who renames the MSI evades it. Q1 and Q4 do not depend on the MSI name.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^msiexec(\.exe)?$/i
| CommandLine=/AllMyBasic\.msi/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: msiexec running AllMyBasic.msi (out-of-channel Romulus bundle)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.007, T1204.002
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msiexec created with AllMyBasic.msi on its command line. The CQL's dot is a regex escape for a literal dot, which contains reproduces exactly.
// REQUIRES: SentinelOne process-creation telemetry with command line
// TUNING: Filename-only signal: a renamed MSI evades it, so read this with the carrier-path hunts on the neighbouring cards.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An MSI renamed before execution is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('msiexec.exe', 'msiexec') tgt.process.cmdline contains 'AllMyBasic.msi'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: msiexec running AllMyBasic.msi (out-of-channel Romulus bundle)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1218.007, T1204.002
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msiexec created with AllMyBasic.msi on its command line. contains is case-insensitive, which reproduces the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Filename-only signal: a renamed MSI evades it, so read this with the carrier-path hunts on the neighbouring cards.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An MSI renamed before execution is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("msiexec.exe", "msiexec")
| where ProcessCommandLine contains "AllMyBasic.msi"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: process running from SM Software Provisioning Service folder
// MITRE: T1574.002, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: process creation with image path
// NOTE: folder name taken from the Siemens ProductCERT warning signs; the legitimate product does not create it.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\SM Software Provisioning Service\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.image.path

// HUNT: process running from SM Software Provisioning Service folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: any created process whose image path contains the provisioning-service folder name between backslashes.
// REQUIRES: SentinelOne process-creation telemetry with image path
// TUNING: The legitimate product does not create this folder; investigate every hit rather than tuning it away.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload moved out of the folder before it runs is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.path contains '\\SM Software Provisioning Service\\'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath
| take 5

// HUNT: process running from SM Software Provisioning Service folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: any created process whose image path contains the provisioning-service folder name between backslashes.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: The legitimate product does not create this folder; investigate every hit rather than tuning it away.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload moved out of the folder before it runs is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FolderPath contains "\\SM Software Provisioning Service\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: archive.dll PE write under AppData\Local
// MITRE: T1574.002, T1105
// CONF: medium  FP: medium  COST: low | REQUIRES: executable write telemetry
// TUNING: exclude writers and folders of applications you own that legitimately ship archive.dll; keep hits written by msiexec or next to SiemensSoftwareCenter.exe.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^archive\.dll$/i
| TargetFileName=/\\AppData\\Local\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: archive.dll PE write under AppData\Local
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1105
// CONF: medium | FP: medium
// EQUIVALENCE: approximate-analytic - The CQL fires on executable-write events, which carry a PE-content verdict. SentinelOne exposes File Creation and File Modification without that verdict, so this matches the filename and folder only. A non-PE file named archive.dll would also match.
// REQUIRES: SentinelOne file creation and modification telemetry
// TUNING: Exclude writers and folders of applications you own that legitimately ship archive.dll; keep hits written by msiexec or next to SiemensSoftwareCenter.exe.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The PE-content verdict of the CQL is not available, so non-PE files named archive.dll also match.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') tgt.file.path matches '\\\\archive\\.dll$' tgt.file.path contains '\\AppData\\Local\\'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: archive.dll PE write under AppData\Local
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1105
// CONF: medium | FP: medium
// EQUIVALENCE: approximate-analytic - The CQL fires on executable-write events, which carry a PE-content verdict. DeviceFileEvents records file creation and modification without that verdict, so this matches the filename and folder only.
// REQUIRES: Defender for Endpoint file event telemetry (DeviceFileEvents)
// TUNING: Exclude writers and folders of applications you own that legitimately ship archive.dll; keep hits written by msiexec or next to SiemensSoftwareCenter.exe.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The PE-content verdict of the CQL is not available, so non-PE files named archive.dll also match.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName =~ "archive.dll"
| where FolderPath contains "\\AppData\\Local\\"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: scheduled task for Siemens Software Center on hosts that never had it
// MITRE: T1053.005
// CONF: medium  FP: medium  COST: low | REQUIRES: scheduled task registration events
// TUNING: exclude hosts in your sanctioned Siemens software group and tasks you can tie to a managed install; keep tasks on hosts with no Siemens software.
#event_simpleName=ScheduledTaskRegistered
| TaskName=/Siemens Software Center|SiemensSoftwareCenter|SM Software Provisioning/i
| table([@timestamp, ComputerName, UserName, TaskName, aid])

event.type = 'Process Creation' tgt.process.cmdline contains '/create'
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: scheduled task for Siemens Software Center on hosts that never had it
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: medium | FP: medium
// EQUIVALENCE: approximate-analytic - No scheduled-task registration event is attested in the SentinelOne field model. This pivots on the schtasks command line that creates a task, which catches command-line registration only.
// REQUIRES: SentinelOne process-creation telemetry with command line
// TUNING: Exclude hosts in your sanctioned Siemens software group and tasks you can tie to a managed install; keep tasks on hosts with no Siemens software.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tasks registered through the Task Scheduler API, COM or an imported XML file without the task name on a command line are not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains '/create' or tgt.process.cmdline contains '-create') (tgt.process.cmdline contains 'Siemens Software Center' or tgt.process.cmdline contains 'SiemensSoftwareCenter' or tgt.process.cmdline contains 'SM Software Provisioning')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: scheduled task for Siemens Software Center on hosts that never had it
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same event population: a task-registration action filtered on the task name. The ScheduledTaskCreated action and its TaskName key are attested in Microsoft hunting repositories rather than on the Learn table page.
// REQUIRES: Defender for Endpoint DeviceEvents with the ScheduledTaskCreated action
// TUNING: Exclude devices in your sanctioned Siemens software group and tasks you can tie to a managed install; keep tasks on devices with no Siemens software.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant does not record ScheduledTaskCreated, the query returns nothing; the readiness test shows which keys are populated.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields)["TaskName"])
| where TaskName contains "Siemens Software Center" or TaskName contains "SiemensSoftwareCenter" or TaskName contains "SM Software Provisioning"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, TaskName, AdditionalFields
| sort by Timestamp desc
| take 200

// HUNT: Run-key persistence for the Siemens carrier
// MITRE: T1547.001
// CONF: medium  FP: medium  COST: low | REQUIRES: auto-start registry telemetry
// TUNING: exclude hosts in your sanctioned Siemens software group; keep values that point at AppData.
#event_simpleName=AsepValueUpdate
| RegObjectName=/\\CurrentVersion\\Run/i
| RegValueName=/Siemens Software Center/i or RegStringValue=/AppData\\Local\\Programs\\.*SiemensSoftwareCenter\.exe|SM Software Provisioning Service/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid])

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.valueName, registry.value

// HUNT: Run-key persistence for the Siemens carrier
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Run-key value written with the product name, the provisioning folder, or a per-user Programs path to the carrier. The CQL requires the path to precede the carrier name; here both are required as substrings without order.
// REQUIRES: SentinelOne registry value modification telemetry
// TUNING: Exclude hosts in your sanctioned Siemens software group; keep values that point at AppData.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL's ordering of path before carrier name is relaxed, which can only widen the match.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath contains '\\CurrentVersion\\Run' (registry.valueName contains 'Siemens Software Center' or registry.value contains 'SM Software Provisioning Service' or (registry.value contains '\\AppData\\Local\\Programs\\' and registry.value contains 'SiemensSoftwareCenter.exe'))
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value, agent.uuid
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| take 5

// HUNT: Run-key persistence for the Siemens carrier
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceRegistryEvents: a Run-key value written with the product name, the provisioning folder, or a per-user Programs path followed by the carrier name, using the same ordered regex as the CQL.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Exclude devices in your sanctioned Siemens software group; keep values that point at AppData.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Values written through a path the sensor does not log as RegistryValueSet are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\CurrentVersion\\Run"
| where RegistryValueName contains "Siemens Software Center" or RegistryValueData contains "SM Software Provisioning Service" or RegistryValueData matches regex @"(?i)AppData\\Local\\Programs\\.*SiemensSoftwareCenter\.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: connections to Siemens-published Romulus bundle IPs
// MITRE: T1071.001, T1105
// CONF: high  FP: low  COST: low | REQUIRES: outbound IPv4 connection telemetry
// NOTE: single upstream (Siemens ProductCERT). Run over the longest retention; the distribution IP is inactive so only historic hits matter.
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["96.62.218.59", "2.27.248.127"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, dst.ip.address, dst.port.number

// HUNT: connections to Siemens-published Romulus bundle IPs
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an IPv4 connection whose destination is one of the two published addresses. The acting process on a network event is src.process.*.
// REQUIRES: SentinelOne IP Connect telemetry
// TUNING: Single upstream source (Siemens ProductCERT). Run over the longest retention; the distribution address is inactive, so only historic hits matter.
// LOOKBACK: Longest retention available; the CQL tab is run over the same range
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through a proxy show the proxy address, not the campaign address.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('96.62.218.59', '2.27.248.127')
| columns event.time, endpoint.name, src.process.user, src.process.name, src.ip.address, dst.ip.address, dst.port.number, agent.uuid
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: connections to Siemens-published Romulus bundle IPs
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceNetworkEvents: remote address is one of the two published addresses.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Single upstream source (Siemens ProductCERT). The distribution address is inactive, so only historic hits matter.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the longest retention available)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so older historic hits are visible only on the CQL tab. Connections made through a proxy show the proxy address, not the campaign address.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("96.62.218.59", "2.27.248.127")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| sort by Timestamp desc
| take 200

// HUNT: DNS requests for the Siemens-published Romulus domain
// MITRE: T1071.004, T1105
// CONF: high  FP: low  COST: low | REQUIRES: DNS request telemetry with requesting process
// NOTE: single upstream (Siemens ProductCERT).
#event_simpleName=DnsRequest
| DomainName=/(^|\.)wizardexpensive\.com$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid])

event.category = 'dns'
| limit 5
| columns event.time, event.type, event.dns.request, dns.request

// HUNT: DNS requests for the Siemens-published Romulus domain
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.004, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS request for wizardexpensive.com or any subdomain of it, using the same anchored regex. The request name is event.dns.request, which the independent pySigma backend attests; the vendor field docs name dns.request instead.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requesting process
// TUNING: Single upstream source (Siemens ProductCERT). Any hit on a host with no sanctioned Siemens software is in scope.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant populates dns.request instead, the query returns nothing until the field is swapped.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)wizardexpensive\\.com$'
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS requests for the Siemens-published Romulus domain
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.004, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS request for wizardexpensive.com or any subdomain of it. Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action's AdditionalFields.
// REQUIRES: Defender for Endpoint DeviceEvents with the DnsQueryResponse action
// TUNING: Single upstream source (Siemens ProductCERT). Any hit on a device with no sanctioned Siemens software is in scope.
// LOOKBACK: 30d (Advanced Hunting retention); the CQL tab covers the longest retention available
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so older hits are visible only on the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName =~ "wizardexpensive.com" or QueryName endswith ".wizardexpensive.com"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, QueryName, ActionType, AdditionalFields
| sort by Timestamp desc
| take 200

// HUNT: Siemens-published campaign file hashes
// MITRE: T1574.002, T1204.002
// CONF: high  FP: low  COST: low | REQUIRES: file hash on process and executable-write events
// NOTE: single upstream (Siemens ProductCERT). Detect only. The genuine SiemensSoftwareCenter.exe hash is deliberately absent.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA256HashData, values=["f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a", "3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491"])
| table([@timestamp, #event_simpleName, ComputerName, UserName, FileName, TargetFileName, ImageFileName, SHA256HashData, aid])

tgt.process.image.sha256 = *
| limit 5
| columns event.time, event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Siemens-published campaign file hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1204.002
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: either published SHA-256 on a created process image or on a written file. SentinelOne attests SHA-256 on both, so both halves of the CQL's event population are covered.
// REQUIRES: SentinelOne process-creation and file telemetry with SHA-256 populated
// TUNING: Single upstream source (Siemens ProductCERT). Detect only; do not block on these hashes without confirming against the genuine product.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Hosts or event types where the agent does not compute SHA-256 return nothing.
// VALIDATION LEVEL: static-reviewed
(tgt.process.image.sha256 in:anycase ('f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a', '3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491') or tgt.file.sha256 in:anycase ('f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a', '3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491'))
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.image.path, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, SHA256
| take 5

// HUNT: Siemens-published campaign file hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1204.002
// CONF: high | FP: low
// EQUIVALENCE: telemetry-gap - Partial pivot: DeviceFileEvents covers the written-file half of the CQL's population. The process-start half is left out because a query reads one table, and SHA256 is often unpopulated in the Device tables.
// REQUIRES: Defender for Endpoint file event telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: Single upstream source (Siemens ProductCERT). Detect only; do not block on these hashes without confirming against the genuine product.
// LOOKBACK: 30d (Advanced Hunting retention); the CQL tab covers the longest retention available
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process started from a file with one of these hashes is not matched, because the process-start table is not read. SHA256 is often unpopulated, so a clean result is weaker than the CQL tab's. Advanced Hunting keeps 30 days; older hits are visible only on the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a", "3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: rare external destinations of the Siemens carrier process
// MITRE: T1071.001
// CONF: low  FP: high  COST: medium | REQUIRES: outbound IPv4 connection telemetry with process name
// TUNING: build an allowlist of Siemens destinations from 30 days of clean hosts and subtract it; escalate any destination with Hosts=1 that is not on it.
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^SiemensSoftwareCenter(\.exe)?$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([RemoteAddressIP4, RemotePort], function=[count(as=Conns), count(aid, distinct=true, as=Hosts), collect([ComputerName])], limit=500)
| sort(Hosts, order=asc, limit=100)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, src.process.name, dst.ip.address, dst.port.number, agent.uuid

// HUNT: rare external destinations of the Siemens carrier process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001
// CONF: low | FP: high
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping: connections by the carrier process to destinations outside the five private and local ranges, grouped by address and port with a distinct-host count. Host names are sampled with any() instead of collected.
// REQUIRES: SentinelOne IP Connect telemetry with the connecting process
// TUNING: Build an allowlist of Siemens destinations from 30 days of clean hosts and subtract it; escalate any destination seen on one host that is not on it.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only a single sample host is listed per destination.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name in:anycase ('SiemensSoftwareCenter.exe', 'SiemensSoftwareCenter') !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group conns=count(), hosts=estimate_distinct(agent.uuid), sample_host=any(endpoint.name) by dst.ip.address, dst.port.number
| sort +hosts
| limit 100

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort, DeviceId
| take 5

// HUNT: rare external destinations of the Siemens carrier process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001
// CONF: low | FP: high
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping: connections by the carrier process to destinations outside the five private and local ranges, grouped by address and port with a distinct-device count.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Build an allowlist of Siemens destinations from 30 days of clean devices and subtract it; escalate any destination seen on one device that is not on it.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Host names are capped at 20 per destination.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("SiemensSoftwareCenter.exe", "SiemensSoftwareCenter")
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or ipv4_is_in_range(RemoteIP, "169.254.0.0/16"))
| summarize Conns = count(), Hosts = dcount(DeviceId), HostNames = make_set(DeviceName, 20) by RemoteIP, RemotePort
| sort by Hosts asc
| take 100

// HUNT: shell or script interpreter child of the Siemens carrier
// MITRE: T1059, T1574.002
// CONF: low  FP: medium  COST: low | REQUIRES: process creation with parent and command line
// TUNING: exclude CommandLine values of the Siemens installer wrapper after you baseline it; any interpreter on a host with no sanctioned Siemens software stays in scope.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^SiemensSoftwareCenter(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: shell or script interpreter child of the Siemens carrier
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059, T1574.002
// CONF: low | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an interpreter or script host created by the carrier process. On a Process Creation event the creator is src.process.* and the created process is tgt.process.*.
// REQUIRES: SentinelOne process-creation telemetry with creator and command line
// TUNING: Exclude command lines of the Siemens installer wrapper after you baseline it; any interpreter on a host with no sanctioned Siemens software stays in scope.
// LOOKBACK: 7d on the CQL tab; set the console time picker to the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Interpreters launched by a child of the carrier rather than the carrier itself are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('SiemensSoftwareCenter.exe', 'SiemensSoftwareCenter') tgt.process.name in:anycase ('cmd.exe', 'cmd', 'powershell.exe', 'powershell', 'pwsh.exe', 'pwsh', 'wscript.exe', 'wscript', 'cscript.exe', 'cscript', 'mshta.exe', 'mshta', 'rundll32.exe', 'rundll32', 'regsvr32.exe', 'regsvr32')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: shell or script interpreter child of the Siemens carrier
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059, T1574.002
// CONF: low | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an interpreter or script host created by the carrier process. The created process is FileName and its creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude command lines of the Siemens installer wrapper after you baseline it; any interpreter on a device with no sanctioned Siemens software stays in scope.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Interpreters launched by a child of the carrier rather than the carrier itself are not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("SiemensSoftwareCenter.exe", "SiemensSoftwareCenter")
| where FileName in~ ("cmd.exe", "cmd", "powershell.exe", "powershell", "pwsh.exe", "pwsh", "wscript.exe", "wscript", "cscript.exe", "cscript", "mshta.exe", "mshta", "rundll32.exe", "rundll32", "regsvr32.exe", "regsvr32")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200