Adversaries may infect Siemens PLC project files (i.e., Step 7, WinCC, etc.) to achieve Execution, Persistence, and Lateral Movement objectives. Adversaries may modify an existing project file or bring their own project files into the environment.[1]
The ability for an adversary to deploy an infected project file relies on access to a workstation with Siemens PLC programming software installed on it from which a program download can be performed.
| ID | Name | Description |
|---|---|---|
| S0603 | Stuxnet |
Stuxnet copies itself into Step 7 projects in such a way that it automatically executes when the Step 7 project is loaded. [1] |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| ID | Mitigation | Description |
|---|---|---|
| M0947 | Audit |
Review the integrity of project files to verify they have not been modified by adversary behavior. Verify a cryptographic hash for the file with a known trusted version, or look for other indicators of modification (e.g., timestamps). |
| M0945 | Code Signing |
Allow for code signing of any project files stored at rest to prevent unauthorized tampering. Ensure the signing keys are not easily accessible on the same system. |
| M0941 | Encrypt Sensitive Information |
When at rest, project files should be encrypted to prevent unauthorized changes.[2] |
| M0922 | Restrict File and Directory Permissions |
Ensure permissions restrict project file access to only engineer and technician user groups and accounts. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0906 | Detection of Siemens Project File Format Infection | AN2049 |
Configured Windows object-access monitoring identifies a write to a Siemens project file by a process that is not the Siemens Totally Integrated Automation (TIA) Portal or Step7 engineering software, or by the legitimate Siemens tool immediately after loading a project from an untrusted path. Directly documented as a Stuxnet mechanism. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity. |
| AN2120 |
Real-time monitoring identifies a write to a Siemens project file path on a Linux engineering workstation from a User Identifier (UID) not associated with the Siemens engineering tool runtime. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |