Threat video1:00
CVE-2025-30033 Siemens SIWA DLL Hijack: Detection & IOCs
Siemens first disclosed this in 2025. Planted DLLs run code in SIWA installers; the free Splunk SPL rule leads 9 detection rules and 17 IOCs.
Read the full threat intel for CVE-2025-30033 Siemens SIWA DLL Hijack: Detection & IOCs →
Chapters
- 0:00The hookOver one hundred Siemens products vulnerable.
- 0:04The storyA malicious DLL hijacks the Siemens installer.
- 0:12Attack pathA victim downloads the installer.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise2 indicators to hunt: 1 path and 1 package name.
- 0:37MITRE ATT&CK techniques3 ATT&CK techniques, from execution to stealth.
- 0:42Remediation3 steps now: Install Siemens applications only from an empty directory so no.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Over one hundred Siemens products vulnerable.
0:05A malicious DLL hijacks the Siemens installer.
0:08Affects over one hundred industrial products.
0:13A victim downloads the installer. The user launches setup.
0:16Then the installer loads a hidden malicious DLL.
0:20Attacker code executes with the user's privileges.
0:27No threat actor is attributed. Confidence: low.
0:322 indicators to hunt: 1 path and 1 package name.
0:383 ATT&CK techniques, from execution to stealth.
0:433 steps now: Install Siemens applications only from an empty directory so no.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.