Detect OpenPLC ScadaBR Cross-Site Scripting (XSS) Exploitation Detected in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2021-26829, a stored or reflected cross-site scripting vulnerability in OpenPLC ScadaBR. ScadaBR is a SCADA/HMI platform used in industrial control environments. Successful exploitation allows attackers to inject malicious scripts into the web interface, potentially enabling session hijacking, credential theft, or lateral movement within OT/ICS environments. This CVE is listed on CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
KQL Detection Query
union isfuzzy=true
(
W3CIISLog
| where csUriStem contains "/ScadaBR" or csHost contains "scadabr" or csUriStem contains "/scada"
| where csUriQuery matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\(|document\.cookie|<img[^>]+src[^>]*=|<svg[^>]+onload)"
or csReferer matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\()"
| project TimeGenerated, csHost, csUriStem, csUriQuery, csReferer, cIP, csUsername, scStatus
),
(
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where Message contains "ScadaBR" or requestUri_s contains "/scada"
| where action_s == "Matched" and ruleSetType_s contains "OWASP"
| where details_message_s contains "XSS"
| project TimeGenerated, clientIp_s, requestUri_s, action_s, ruleId_s, details_message_s
),
(
DeviceNetworkEvents
| where RemoteUrl contains "scadabr" or RemoteUrl contains "/ScadaBR"
| where RemoteUrl matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\(|document\.cookie)"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
)
| extend CVE = "CVE-2021-26829"
| extend Severity = "High"
| order by TimeGenerated descDetects HTTP requests to OpenPLC ScadaBR endpoints containing XSS payloads in URI query strings, referrer headers, or matched by WAF rules. Covers IIS logs, Azure Application Gateway firewall logs, and Defender endpoint network telemetry.
Data Sources
Required Tables
False Positives & Tuning
- Security scanners (Nessus, Qualys, Burp Suite) running authorized vulnerability assessments against ScadaBR instances
- Penetration testers performing authorized red team exercises on OT/ICS environments
- WAF rule tuning activities that generate test XSS payloads
- Developers testing input validation in non-production ScadaBR environments
Other platforms for CVE-2021-26829
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Reflected XSS Probe via ScadaBR Search Parameter
Expected signal: Web server access log entry with URI containing '<script>alert(document.cookie)</script>' and HTTP response code (200 if reflected, 400/500 if filtered). WAF logs should show XSS rule match.
- Test 2Stored XSS via ScadaBR Watchlist Name Field
Expected signal: POST request in web access logs to ScadaBR watchList endpoint with body containing XSS payload. Subsequent GET requests loading the watchlist page will serve the stored payload to other authenticated users.
- Test 3Session Cookie Exfiltration Simulation via XSS
Expected signal: Outbound HTTP GET request from the ScadaBR operator's browser/host to the attacker's listener IP on port 8888 with the session cookie in the query parameter. Network flow logs should show the lateral connection from the OT network to the attacker IP.
- Test 4ScadaBR XSS via HTTP Referrer Header Injection
Expected signal: HTTP access log entry showing the malicious Referer header value. If ScadaBR reflects the Referer in error pages or breadcrumbs, the response body will contain the injected script tag.
Unlock Pro Content
Get the full detection package for CVE-2021-26829 including response playbook, investigation guide, and atomic red team tests.