CVE-2025-6205 Splunk · SPL

Detect Dassault Systèmes DELMIA Apriso Missing Authorization (CVE-2025-6205) in Splunk

Detects exploitation attempts targeting CVE-2025-6205, a missing authorization vulnerability (CWE-862) in Dassault Systèmes DELMIA Apriso. This vulnerability allows unauthenticated or low-privileged attackers to access protected resources or perform actions without proper authorization checks. Listed as a CISA KEV, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

SPL Detection Query

Splunk (SPL)
spl 
index=web OR index=iis OR index=windows
(
    (sourcetype=iis OR sourcetype=ms:iis:auto)
    (uri_path="*Apriso*" OR uri_path="*DELMIA*" OR uri_path="*GlobalFluency*" OR uri_path="*Manufacturing*")
    (method=POST OR method=PUT OR method=DELETE OR method=PATCH)
    (
        (username="-" OR username="" OR isnull(username))
        OR (query="*bypass*" OR query="*noauth*" OR query="*auth=skip*" OR query="*anonymous*")
    )
    (status=200 OR status=201 OR status=301 OR status=302)
)
OR
(
    sourcetype=WinEventLog:Security
    EventCode IN (4624, 4625, 4648, 4672)
    (TargetUserName="*apriso*" OR TargetUserName="*delmia*" OR TargetUserName="*mes*")
)
| eval CVE="CVE-2025-6205"
| eval risk_score=case(
    (username="-" AND (method="POST" OR method="DELETE")), 90,
    (query="*bypass*" OR query="*noauth*"), 85,
    EventCode=4625, 60,
    true(), 40
  )
| table _time, host, src_ip, uri_path, method, status, username, query, EventCode, TargetUserName, CVE, risk_score
| sort -risk_score
critical severity medium confidence

Detects unauthenticated or authorization-bypassing requests to DELMIA Apriso web paths and authentication anomalies for Apriso service accounts. Assigns a dynamic risk score based on request characteristics.

Data Sources

IIS Web LogsWindows Event LogsSysmon

Required Sourcetypes

iisms:iis:autoWinEventLog:Security

False Positives & Tuning

  • Legitimate health monitoring probes that do not send authentication headers
  • Integration middleware using session tokens not captured in IIS logs
  • ERP systems polling MES endpoints with shared service accounts
  • Penetration testing or authorized vulnerability scanning activity

Other platforms for CVE-2025-6205

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated HTTP POST to Apriso API Endpoint

    Expected signal: IIS access log entry: POST /Apriso/api/v1/WorkOrders with username '-' or empty and HTTP response code 200/201/401/403. Network flow showing outbound connection to Apriso host on port 80 or 443.

  2. Test 2Apriso Endpoint Enumeration via Unauthenticated GET Scan

    Expected signal: Multiple IIS log entries for sequential GET requests to /Apriso*, /DELMIA*, /GlobalFluency* paths from same source IP within a short time window.

  3. Test 3Authorization Bypass via Query Parameter Manipulation

    Expected signal: IIS log entry with URI /Apriso/api/v1/Users?anonymous=true&auth=skip, method POST, and username '-'. Windows Security Event Log may show no corresponding authentication event.

  4. Test 4Repeated Authentication Failure on Apriso Service Account

    Expected signal: Windows Security Event Log Event ID 4625 (failed logon) for TargetUserName=apriso_svc repeated 10 times within a short window. IIS 401 responses for POST to /Apriso/login.

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify all source IPs accessing Apriso endpoints without valid authentication headers or session tokens within the past 72 hours. Cross-reference with known internal IP ranges to distinguish internal misuse from external exploitation.
  2. Determine the specific Apriso endpoints or API routes accessed — check IIS logs or application logs for URI paths accessed without authorization. Focus on administrative, configuration, or data export endpoints that would be high-value targets.
  3. Check CISA KEV context: CVE-2025-6205 has confirmed active exploitation. Treat any matching activity as potentially active exploitation unless proven otherwise. Escalate immediately if suspicious IPs are external or previously unseen.
  4. Correlate the requesting IP against threat intelligence feeds (e.g., VirusTotal, Shodan, internal blocklists) to assess whether the source is known-malicious, a scanner, or a legitimate integration partner.

Containment

  1. Immediately isolate the Apriso application server from external-facing network segments if external exploitation is confirmed or strongly suspected. Place the host behind an emergency WAF rule blocking the specific URI patterns associated with exploitation.
  2. Revoke or rotate all Apriso service account credentials and API tokens. Enforce re-authentication for all active sessions. If Apriso uses an SSO integration, coordinate with the IdP team to invalidate affected session tokens.
  3. Apply vendor-supplied patches or mitigations from the Dassault Systèmes advisory (https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205) as the primary containment measure once the vendor publishes guidance.

Evidence Collection

  1. Collect full IIS access logs from the Apriso web server for the past 7 days. Export as raw log files and preserve with hash verification (SHA-256) before any remediation activity begins.
  2. Capture memory dump of the Apriso application process if exploitation of a persistent foothold is suspected (e.g., signs of post-exploitation activity such as unexpected child processes or network connections from the Apriso service).
  3. Export Windows Security Event Logs (Event IDs 4624, 4625, 4648, 4672, 4688) from the Apriso host and any adjacent authentication servers (AD DCs) covering the same 7-day window.

Escalation Criteria

  • !Escalate to CISO and executive leadership immediately if any unauthorized access to manufacturing data, production recipes, quality records, or supply chain configurations is confirmed — these represent critical IP theft risk.
  • !Escalate to incident response retainer / DFIR team if post-exploitation indicators are observed: unexpected processes spawned by the Apriso service, outbound connections to unknown IPs, new files created in web directories, or lateral movement from the Apriso host to adjacent OT/MES systems.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS access logs at default path %SystemDrive%\inetpub\logs\LogFiles\W3SVC* — look for POST/PUT/DELETE to /Apriso/ paths with empty or '-' username fields and 2xx/3xx responses
  • >Windows Application Event Log (Event Source: Apriso or DELMIA) for authorization failure or bypass events logged by the application itself
  • >Network flow records (NetFlow/IPFIX) showing connections to Apriso TCP ports (80, 443, 8080) from unexpected source IPs, particularly outside business hours
  • >Apriso application database transaction logs — if accessible, review for unauthorized record modifications, deletions, or exports that correlate with the suspicious web access timeline

Tuning Guidance

Start by baselining all source IPs and user accounts that legitimately access Apriso endpoints. Build an allowlist of known integration systems (ERP connectors, BI tools, scheduler agents) and filter them out. Tune the username=='-' logic against your Apriso authentication configuration — some deployments use token-based or certificate authentication that may not populate the IIS username field even for legitimate sessions. Adjust HTTP method filters to match your organization's Apriso API usage patterns. For environments with a WAF or API gateway in front of Apriso, pull logs from that layer rather than IIS to get pre-decryption source IP fidelity.

Hunting Queries

Threat hunt for source IPs making repeated unauthenticated POST/PUT/DELETE requests to Apriso endpoints over a 7-day window — baseline for identifying systematic authorization bypass probing or exploitation.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/Apriso", "/DELMIA", "/GlobalFluency", "/Manufacturing")
| where csMethod in ("POST", "PUT", "DELETE")
| where isempty(csUsername) or csUsername == "-"
| where scStatus between (200 .. 204) or scStatus between (301 .. 302)
| summarize RequestCount=count(), UniqueURIs=dcount(csUriStem), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by cIP, csMethod
| where RequestCount > 5
| sort by RequestCount desc
Hunting — SPL
spl 
index=iis (uri_path="*Apriso*" OR uri_path="*DELMIA*" OR uri_path="*GlobalFluency*")
(method=POST OR method=PUT OR method=DELETE)
(username="-" OR username="" OR isnull(username))
(status>=200 AND status<=204) OR (status=301 OR status=302)
earliest=-7d
| stats count as request_count, dc(uri_path) as unique_uris, min(_time) as first_seen, max(_time) as last_seen by src_ip, method
| where request_count > 5
| sort -request_count

Atomic Red Team Tests

Test 1 Unauthenticated HTTP POST to Apriso API Endpoint
linux

Simulate an authorization bypass attempt by sending an unauthenticated POST request to a known Apriso API endpoint. This tests whether the target Apriso instance enforces authentication on sensitive endpoints.

Command

bash 
curl -s -o /dev/null -w "%{http_code}" -X POST http://TARGET_APRISO_HOST/Apriso/api/v1/WorkOrders -H 'Content-Type: application/json' -d '{"test": "cve-2025-6205-probe"}' --max-time 10

Cleanup

bash 
No cleanup required — read-only probe. Remove any test entries from Apriso audit logs if the request succeeded.

Expected Telemetry

IIS access log entry: POST /Apriso/api/v1/WorkOrders with username '-' or empty and HTTP response code 200/201/401/403. Network flow showing outbound connection to Apriso host on port 80 or 443.

Expected Detection

KQL W3CIISLog rule should fire on POST to /Apriso/ path with empty username. Splunk SPL rule should match on method=POST, uri_path=*Apriso*, username='-'.

Test 2 Apriso Endpoint Enumeration via Unauthenticated GET Scan
linux

Enumerate accessible Apriso endpoints without authentication to identify which resources are exposed due to missing authorization controls.

Command

bash 
for endpoint in /Apriso /Apriso/api /Apriso/admin /Apriso/config /DELMIA /GlobalFluency /Manufacturing; do echo -n "$endpoint: "; curl -s -o /dev/null -w "%{http_code}" http://TARGET_APRISO_HOST$endpoint --max-time 5; echo; done

Cleanup

bash 
No cleanup required. Document any 200-response endpoints for remediation tracking.

Expected Telemetry

Multiple IIS log entries for sequential GET requests to /Apriso*, /DELMIA*, /GlobalFluency* paths from same source IP within a short time window.

Expected Detection

Chronicle YARA-L and QRadar AQL rules should trigger on multiple unauthenticated requests to Apriso URI paths. CrowdStrike CQL risk score should aggregate above threshold.

Test 3 Authorization Bypass via Query Parameter Manipulation
windows

Attempt to bypass Apriso authorization by injecting query parameters commonly associated with auth bypass patterns (e.g., anonymous=true, auth=skip) on protected endpoints.

Command

powershell 
Invoke-WebRequest -Uri 'http://TARGET_APRISO_HOST/Apriso/api/v1/Users?anonymous=true&auth=skip' -Method POST -ContentType 'application/json' -Body '{"action":"list"}' -UseBasicParsing | Select-Object StatusCode, Content

Cleanup

powershell 
No cleanup required. If any data was returned, document and report to security team.

Expected Telemetry

IIS log entry with URI /Apriso/api/v1/Users?anonymous=true&auth=skip, method POST, and username '-'. Windows Security Event Log may show no corresponding authentication event.

Expected Detection

KQL rule matching csUriQuery containing 'bypass' or 'auth=' or 'anonymous'. Splunk rule matching query field for bypass/noauth patterns. All seven SIEM rules should generate alerts on this activity.

Test 4 Repeated Authentication Failure on Apriso Service Account
windows

Simulate brute-force or credential stuffing against a known Apriso service account to generate authentication failure telemetry that correlates with CVE-2025-6205 exploitation patterns.

Command

powershell 
for ($i=1; $i -le 10; $i++) { try { Invoke-WebRequest -Uri 'http://TARGET_APRISO_HOST/Apriso/login' -Method POST -ContentType 'application/x-www-form-urlencoded' -Body 'username=apriso_svc&password=wrongpassword' -UseBasicParsing | Out-Null } catch {} }

Cleanup

powershell 
Unlock the apriso_svc account if it was locked out by the test. Run: Unlock-ADAccount -Identity apriso_svc

Expected Telemetry

Windows Security Event Log Event ID 4625 (failed logon) for TargetUserName=apriso_svc repeated 10 times within a short window. IIS 401 responses for POST to /Apriso/login.

Expected Detection

KQL SecurityEvent filter on EventID 4625 and TargetUserName matching 'apriso'. Splunk EventCode=4625 rule. QRadar authentication failure AQL query.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1548Abuse Elevation Control Mechanism

Same Tactic: Initial Access

Popular Detections