Trimble Cityworks deserialization RCE exploited in wild

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Authenticated deserialization flaw in Trimble Cityworks allows remote code execution; actively exploited.

A deserialization vulnerability in Trimble Cityworks, a GIS-based asset management system widely used in government and public infrastructure, permits authenticated attackers to execute arbitrary code on affected Microsoft Internet Information Services (IIS) web servers. CISA reports active exploitation in the wild. The vulnerability affects Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10. Successful exploitation allows an attacker to install programs, view, change, or delete data within the privilege context of the compromised account; administrative accounts pose the highest risk. The attack requires authentication but no user interaction. Defenders should prioritize patching affected versions immediately, enforce least-privilege access controls, segment network infrastructure to isolate critical systems, and conduct vulnerability scanning to identify affected deployments.

title: IIS Worker Process Spawning Command Shell or Script Host
description: Detects the IIS worker process w3wp.exe spawning an interpreter (cmd,
  PowerShell, mshta, wscript, cscript). This is the usual process pattern after exploiting
  a deserialization RCE in an IIS-hosted application such as Trimble Cityworks, and
  it also matches webshell use. Generalises on the parent/child relation, not on a
  specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legacy IIS web applications that deliberately shell out to cmd.exe for batch jobs
- Administrative web apps that invoke PowerShell for management tasks
level: medium
id: 6289c4ab-008a-533f-bc80-7dabb2c850a2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014

title: IIS Worker Process Spawning Download or Staging Tool
description: Detects w3wp.exe launching file-transfer utilities or PowerShell download
  cradles, indicating a multi-stage intrusion where the initial web exploit (such
  as the Cityworks deserialization RCE) pulls down further tooling.
tags:
- attack.command-and-control
- attack.t1104
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \w3wp.exe
  selection_img:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  selection_cli:
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Net.WebClient
    - Start-BitsTransfer
    - urlcache
    - 'iwr '
  condition: selection_parent and (selection_img or selection_cli)
falsepositives:
- Web applications that legitimately call curl.exe to reach internal APIs
level: high
id: e9852e6f-c4d0-59cf-8da0-95c7a3f6ebea
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014

title: IIS Worker Process Spawning Reconnaissance Commands
description: Detects the IIS worker process spawning host and domain discovery utilities.
  After exploiting an IIS-hosted app (for example Cityworks), attackers commonly check
  their privilege context and the environment first.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \whoami.exe
    - \systeminfo.exe
    - \ipconfig.exe
    - \nltest.exe
    - \net.exe
    - \net1.exe
    - \quser.exe
    - \tasklist.exe
  condition: selection
falsepositives:
- Web-based server monitoring or diagnostics pages that run ipconfig or tasklist
level: high
id: 94b128f6-5a16-53cd-b4a7-8f6315f5fca2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014