Detect Siemens Software Center Uncontrolled Search Path Element Exploitation (CVE-2026-110936) in Microsoft Sentinel
Detects exploitation of CVE-2026-110936, an uncontrolled search path element (DLL search-order hijacking) vulnerability in Siemens Software Center. An attacker who can place a malicious DLL in a directory searched before the legitimate library path can achieve code execution in the context of the Software Center process. This CVE is on the CISA KEV catalog and has been observed in ClickFix social-engineering campaigns that trick users into placing or executing attacker-staged payloads. Detection focuses on Software Center loading unsigned or unexpected DLLs from writable/user-controlled directories, suspicious child processes spawned by Software Center binaries, and new DLL file writes into the Software Center install or working directories.
MITRE ATT&CK
KQL Detection Query
let swcProcs = dynamic(["softwarecenter.exe","siemens software center.exe","swcenter.exe","softwarecenterservice.exe"]);
let writableRoots = dynamic(["\\users\\","\\appdata\\","\\temp\\","\\downloads\\","\\public\\","\\programdata\\"]);
union
(
DeviceImageLoadEvents
| where InitiatingProcessFileName in~ (swcProcs)
| where FileName endswith ".dll"
| where (isempty(InitiatingProcessFolderPath) == false and tolower(FolderPath) !startswith tolower(InitiatingProcessFolderPath))
or tolower(FolderPath) has_any (writableRoots)
| extend Signal = "suspicious_dll_load"
),
(
DeviceProcessEvents
| where InitiatingProcessFileName in~ (swcProcs)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe")
| extend Signal = "suspicious_child_process"
)
| project Timestamp, DeviceName, Signal, InitiatingProcessFileName, FileName, FolderPath, InitiatingProcessFolderPath, InitiatingProcessCommandLine, AccountName
| order by Timestamp descFlags Software Center loading DLLs from outside its install directory or from user-writable locations, and Software Center spawning common LOLBin/script interpreters indicative of search-path hijack exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Siemens plug-ins or add-ons installed to non-default directories
- Software Center update routines that temporarily stage DLLs in ProgramData or Temp
- IT automation launching scripts as a child of Software Center during managed deployments
Other platforms for CVE-2026-110936
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulated DLL search-order hijack of Software Center
Expected signal: Sysmon Event ID 11 (file create) for the DLL and Event ID 7 (image load) from the Software Center process referencing the APPDATA path.
- Test 2 Software Center spawns PowerShell (child-process signal)
Expected signal: Sysmon Event ID 1 (process create) showing PowerShell with a Software Center parent image.
- Test 3 ClickFix-style mshta one-liner execution
Expected signal: Sysmon Event ID 1 recording mshta.exe execution with a scripting command line.
- Test 4 Unsigned DLL load from Temp (linux wine lab analog)
Expected signal: File creation event for /tmp/version.so and subsequent module load if exercised by the harness.
References (5)
- https://productcert.siemens.com/productcert/html/ssa-580366.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-110936
- https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
Response Playbook
Triage
- Identify the host and user running Software Center and confirm the exact installed version against Siemens advisory SSA-580366 to determine exploitability.
- Examine the suspicious DLL: capture its full path, hash, and digital signature status, and compare against the legitimate Siemens-signed library it is impersonating.
- Review the Software Center install directory and the DLL load path for recently created or modified DLLs and determine whether the directory is user-writable.
- Correlate the event with any preceding ClickFix-style user activity (clipboard-pasted commands, fake CAPTCHA pages, mshta/powershell one-liners) in browser and process telemetry.
Containment
- Isolate the affected host from the network via EDR to prevent lateral movement or payload retrieval.
- Quarantine or remove the malicious DLL and block its hash across the EDR fleet.
- Suspend the involved user session/credentials if compromise of user context is suspected pending investigation.
Evidence Collection
- Collect the malicious DLL, its parent directory listing, and file metadata (MFT timestamps, prefetch) for forensic analysis.
- Export Sysmon/EDR process, image-load, and file-creation events for the Software Center process over the surrounding 24 hours.
- Preserve browser history, downloads, and clipboard-related artifacts to establish the ClickFix initial-access vector.
Escalation Criteria
- !Escalate to incident response if the loaded DLL is confirmed unsigned/malicious and executed code, indicating active exploitation.
- !Escalate if child processes performed network connections, credential access, or persistence establishment.
- !Escalate to OT/ICS security leadership if the affected host has connectivity to operational technology or engineering networks given Siemens deployment context.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Unsigned or mismatched DLL present in the Software Center install or working directory - >
Sysmon Event ID 7 (image load) records referencing untrusted DLL paths under the Software Center process - >
Prefetch and MFT $STANDARD_INFORMATION timestamps showing recent DLL creation prior to Software Center launch - >
Browser download and clipboard artifacts tying initial access to a ClickFix lure
Tuning Guidance
Baseline the legitimate set of DLLs and directories loaded by Software Center in your environment, then exclude signed vendor libraries and known updater staging paths. Narrow the writable-path list to directories genuinely user-controllable in your deployment. If Software Center legitimately spawns scripts during managed deployments, scope those exclusions to the specific deployment tooling parent-child chains rather than disabling the child-process signal entirely.
Hunting Queries
Hunts for Software Center loading DLLs from user-writable directories across the environment to surface previously missed search-path hijacks.
DeviceImageLoadEvents | where InitiatingProcessFileName in~ ("softwarecenter.exe","swcenter.exe") | summarize count(), make_set(FolderPath) by DeviceName, FileName | where FolderPath has_any ("\\users\\","\\appdata\\","\\temp\\")sourcetype=Sysmon EventCode=7 Image="*SoftwareCenter.exe" (ImageLoaded="*\\Users\\*" OR ImageLoaded="*\\AppData\\*" OR ImageLoaded="*\\Temp\\*") | stats count by host, ImageLoaded, SignedAtomic Red Team Tests
Places a benign unsigned DLL named after a library Software Center loads into a writable directory on the search path to validate image-load detection.
Command
copy %WINDIR%\System32\version.dll "%APPDATA%\version.dll" && echo Placed test DLL on search path for Software CenterCleanup
del "%APPDATA%\version.dll"Expected Telemetry
Sysmon Event ID 11 (file create) for the DLL and Event ID 7 (image load) from the Software Center process referencing the APPDATA path.
Expected Detection
kql and spl image-load rules flag a DLL load by Software Center from a user-writable directory.
Launches a process whose parent chain mimics Software Center invoking PowerShell to validate the suspicious-child-process branch.
Command
powershell.exe -NoProfile -Command "Write-Output 'atomic-test-child-process'"Cleanup
echo No cleanup required; process exits immediatelyExpected Telemetry
Sysmon Event ID 1 (process create) showing PowerShell with a Software Center parent image.
Expected Detection
The child-process branch of the kql/spl/elastic_eql rules fires on Software Center spawning powershell.exe.
Executes a benign mshta command mirroring the ClickFix lure pattern associated with CVE-2026-110936 campaigns.
Command
mshta.exe "javascript:close(alert('atomic-clickfix-test'))"Cleanup
echo No cleanup required; mshta closes after the alertExpected Telemetry
Sysmon Event ID 1 recording mshta.exe execution with a scripting command line.
Expected Detection
Suspicious interpreter execution is flagged when parented to Software Center; standalone mshta execution surfaces in hunting queries.
Lab-only analog staging an unsigned shared object to validate untrusted-module-load logic in a cross-platform test harness.
Command
cp /bin/true /tmp/version.so && echo 'Staged unsigned module in /tmp for load-path test'Cleanup
rm -f /tmp/version.soExpected Telemetry
File creation event for /tmp/version.so and subsequent module load if exercised by the harness.
Expected Detection
Untrusted-module-load logic flags loading of an unsigned object from a world-writable directory.