Siemens Software Center uncontrolled DLL search path enabling signed-binary sideloading

#Requires -Version 3.0
<#
  Check-CVE2026110936.ps1
  Detects vulnerable Siemens Software Center installations AND
  indicators of ROMULUS/ClickFix compromise artifacts.
  Output: VULNERABLE / PATCHED / COMPROMISED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 2 = COMPROMISED, 0 = PATCHED, 3 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'4.0.9.8'
$found = $false
$vulnerable = $false
$compromised = $false

# --- Check 1: Legitimate Siemens Software Center installations ---
$searchPaths = @(
    "$env:ProgramFiles\Siemens",
    "${env:ProgramFiles(x86)}\Siemens",
    "$env:ProgramData\Siemens"
)

foreach ($base in $searchPaths) {
    if (Test-Path $base) {
        $exes = Get-ChildItem -Path $base -Recurse -Filter 'SiemensSoftwareCenter.exe' -ErrorAction SilentlyContinue
        foreach ($exe in $exes) {
            $found = $true
            $ver = [version]$exe.VersionInfo.FileVersion
            if ($ver -lt $fixedVersion) {
                Write-Host "[!] VULNERABLE: $($exe.FullName) — version $ver (< $fixedVersion)"
                $vulnerable = $true
            } else {
                Write-Host "[+] PATCHED: $($exe.FullName) — version $ver"
            }
        }
    }
}

# --- Check 2: BYOB / ROMULUS compromise indicators ---
$suspectPaths = @(
    "$env:LOCALAPPDATA\Programs\SM Software Provisioning Service\SiemensSoftwareCenter.exe",
    "$env:LOCALAPPDATA\Programs\SiemensSoftwareCenter.exe"
)
$artifactFiles = @(
    "$env:LOCALAPPDATA\Programs\SM Software Provisioning Service\activate.bak",
    "$env:LOCALAPPDATA\Programs\SM Software Provisioning Service\statinfosta.DB",
    "$env:LOCALAPPDATA\Programs\SM Software Provisioning Service\archive.dll",
    "$env:LOCALAPPDATA\FTSuite\ftc.uml"
)

foreach ($sp in $suspectPaths) {
    if (Test-Path $sp) {
        Write-Host "[!!] COMPROMISED INDICATOR: Siemens binary in user-writable path: $sp"
        $compromised = $true
    }
}

foreach ($af in $artifactFiles) {
    if (Test-Path $af) {
        Write-Host "[!!] COMPROMISED INDICATOR: ROMULUS artifact found: $af"
        $compromised = $true
        # Check archive.dll hash if present
        if ($af -like '*archive.dll') {
            $hash = (Get-FileHash -Path $af -Algorithm SHA256).Hash
            if ($hash -eq '3FDCC7D7D049A89711FB31FB236940A1C5A09D899143FFD20C3C41FB1F2CF491') {
                Write-Host "[!!] CONFIRMED: archive.dll matches known malicious hash"
            }
        }
    }
}

# --- Verdict ---
if ($compromised) {
    Write-Host "`nRESULT: COMPROMISED — active ROMULUS/ClickFix indicators found. Isolate host immediately."
    exit 2
} elseif ($vulnerable) {
    Write-Host "`nRESULT: VULNERABLE — Siemens Software Center < $fixedVersion detected."
    exit 1
} elseif ($found) {
    Write-Host "`nRESULT: PATCHED — all Siemens Software Center installations >= $fixedVersion."
    exit 0
} else {
    Write-Host "`nRESULT: UNKNOWN — Siemens Software Center not found in standard paths. Note: BYOB attacks can target any host."
    exit 3
}