CVE-2026-85479

Sentinel/Defender KQL

// This query is a placeholder and needs customization.
// It aims to detect unauthenticated network connections to the openPDC STTP data publisher.
// You need to identify the specific process and port used by openPDC's STTP publisher.
// Replace 'openPDC_ProcessName' and 'openPDC_STTP_Port' with actual values.
DeviceNetworkEvents
| where InitiatingProcessFileName == "openPDC_ProcessName"
| where RemotePort == openPDC_STTP_Port
| where ActionType == "ConnectionSuccess"
// Further filtering might be needed to identify 'unauthenticated' connections
// which could involve looking for specific traffic patterns or lack of authentication headers/payloads
// This is highly dependent on the application's network behavior.

Splunk SPL

# This query is a placeholder and needs customization.
# It aims to detect unauthenticated network connections to the openPDC STTP data publisher.
# You need to identify the specific process and port used by openPDC's STTP publisher.
# Replace 'openPDC_ProcessName' and 'openPDC_STTP_Port' with actual values.
index=your_network_logs sourcetype=your_firewall_or_netflow_data
| where dest_port=openPDC_STTP_Port
| where dest_process="openPDC_ProcessName"
| stats count by src_ip, dest_ip, dest_port, dest_process
# Further filtering might be needed to identify 'unauthenticated' connections
# which could involve looking for specific traffic patterns or lack of authentication headers/payloads
# This is highly dependent on the application's network behavior.

Sigma

title: OpenPDC Unauthenticated STTP Connection
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects unauthenticated network connections to the openPDC STTP-based data publisher.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    TargetPort: <openPDC_STTP_Port> # Replace with actual STTP port
    InitiatingProcessName|endswith: 'openPDC_ProcessName.exe' # Replace with actual process name
  condition: selection
fields:
  - InitiatingProcessName
  - TargetPort
  - SourceIp
  - DestinationIp
level: medium
tags:
  - attack.initial_access
  - cve.2026.85479

Elastic ES|QL

// This query is a placeholder and needs customization.
// It aims to detect unauthenticated network connections to the openPDC STTP data publisher.
// You need to identify the specific process and port used by openPDC's STTP publisher.
// Replace 'openPDC_ProcessName' and 'openPDC_STTP_Port' with actual values.
from network where destination.port == openPDC_STTP_Port and process.name == "openPDC_ProcessName"
// Further filtering might be needed to identify 'unauthenticated' connections
// which could involve looking for specific traffic patterns or lack of authentication headers/payloads
// This is highly dependent on the application's network behavior.
| stats count() by source.ip, destination.ip, destination.port, process.name