Configured Windows object-access monitoring identifies a write to a Siemens project file by a process that is not the Siemens Totally Integrated Automation (TIA) Portal or Step7 engineering software, or by the legitimate Siemens tool immediately after loading a project from an untrusted path. Directly documented as a Stuxnet mechanism. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | WinEventLog:Security | Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path |
| File Modification (DC0061) | WinEventLog:Sysmon | Siemens engineering tool opens project file from path not in approved project repository |
| Field | Description |
|---|---|
| ApprovedProjectRepository | Documented, trusted source location(s) for Siemens project files. |
Real-time monitoring identifies a write to a Siemens project file path on a Linux engineering workstation from a User Identifier (UID) not associated with the Siemens engineering tool runtime. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs |
| Field | Description |
|---|---|
| ApprovedProjectRepository | Documented, trusted source location(s) for Siemens project files. |
| ID | Asset |
|---|---|
| A0001 | Workstation |