Rockwell Automation Arena RCE via malicious DOE files

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Nine code execution flaws in Rockwell Automation Arena up to v16.20.08 require user interaction to load malicious model files.

Rockwell Automation released an Update B advisory for Arena, an industrial automation simulation and design software, addressing nine vulnerabilities that allow arbitrary code execution. All vulnerabilities require a user to load a crafted DOE (Design of Experiment) model file to trigger exploitation, meaning no remote attack is possible without user interaction. The flaws span memory safety issues including use-after-free, out-of-bounds read/write, and uninitialized variable access across multiple Arena versions. Affected versions range from Arena v16.20.00 through v16.20.08 (with some affecting earlier patch levels), and both 32-bit and 64-bit builds are impacted. The vendor recommends immediate upgrade to v16.20.09 or later. Interim mitigations include avoiding untrusted model files and holding the control key during file load to prevent VBA stream processing. CISA reports no known public exploitation of these vulnerabilities at this time.

title: Rockwell Arena Spawning Shell or Script Interpreter
description: Detects Rockwell Arena simulation software spawning command interpreters
  or common download/execution LOLBins. Arena does not normally launch these, so this
  is consistent with memory-corruption exploitation via a malicious DOE file or abuse
  of embedded VBA.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Arena.exe
    - \Arena64.exe
    - \Arena32.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \curl.exe
  condition: selection
falsepositives:
- Custom Arena models or VBA integrations that intentionally shell out to cmd.exe
  for data export or automation
level: high
id: 47c2569d-0afd-5f8e-bbb3-cd5594ff9f41
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06

title: Rockwell Arena Opening DOE File From User-Writable or Mail/Download Location
description: Detects Arena being started with a .doe model file located in download,
  temp, or email attachment cache directories. Crafted DOE files must be loaded by
  the user to trigger the Arena RCE flaws, so untrusted-origin model loads are a useful
  triage signal.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \Arena.exe
    - \Arena64.exe
    - \Arena32.exe
  selection_file:
    CommandLine|contains: .doe
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Content.Outlook\
    - \INetCache\
    - \Temporary Internet Files\
  condition: selection_img and selection_file and selection_path
falsepositives:
- Engineers legitimately opening vendor- or colleague-supplied DOE models that were
  just downloaded
- Users opening model attachments directly from email
level: medium
id: 7bbc9e84-1c73-5cf5-be14-484966d6b995
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06

title: DOE Model File Delivered by Email Client or Browser
description: Detects creation of .doe (Arena Design of Experiment) files by mail clients
  or web browsers. Delivery by phishing attachment or download is the realistic route
  to exploit the Arena vulnerabilities, which need a user to load the file. Most useful
  on hosts that do not normally handle Arena models.
tags:
- attack.initial-access
- attack.t1566
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \outlook.exe
    - \thunderbird.exe
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    TargetFilename|endswith: .doe
  condition: selection
falsepositives:
- Simulation engineers who exchange Arena models by email or download them from vendor
  portals
level: low
id: e2f1f853-a397-5004-a7d3-767cb24a2783
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06