Name:PTC Windchill Gateway Command Execution id:d725b390-fe86-47df-b9a1-57497915403e version:1 date:None author:Nasreddine Bencherchali, Splunk status:production type:Anomaly Description:This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation.
PTC identifies `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=` request patterns as indicators to monitor during Windchill and FlexPLM exploitation response.
Successful activity may allow an unauthenticated attacker to execute operating system commands or read files through a weaponized gateway or JSP component.
Data_source:
-Windchill Log4j
search:`windchill_log4j` ("WindchillGW/GW/run" OR "WindchillAuthGW/GW/run" OR "/GW/run?" OR "run?c=" OR "run?p=" OR ".jsp?c=" OR ".jsp?p=" OR "dpr_") | rex field=_raw "^(?:[^:\r\n]+:)?(?<log_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?<log_level>\w+)\s+\[(?<thread>[^\]]+)\]\s+(?<logger>\S+)\s+-\s+(?<payload>.*)$" | search logger IN ("wt.servlet.ServletRequestMonitor.request", "wt.method.MethodContextMonitor.contexts.servletRequest") | rex field=payload "^(?<event_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?<event_tz>[+\-]\d{4}),\s+(?<rest>.*)$" | eval parts=split(rest,", ") | eval event_type=case(logger="wt.servlet.ServletRequestMonitor.request","servlet_request",logger="wt.method.MethodContextMonitor.contexts.servletRequest","method_context_servlet_request",true(),"other") | eval src_ip=case(event_type="servlet_request",mvindex(parts,2),event_type="method_context_servlet_request",mvindex(parts,5)) | eval uri_path=case(event_type="servlet_request",mvindex(parts,3),event_type="method_context_servlet_request",mvindex(parts,8)) | eval query_string=if(event_type="servlet_request",mvindex(parts,4),null()) | eval http_method=if(event_type="servlet_request",mvindex(parts,5),null()) | eval status=if(event_type="servlet_request",tonumber(mvindex(parts,6)),null()) | rex field=uri_path "^(?<uri_only>[^\?]+)(?:\?(?<uri_query>.*))?$" | eval query_string=if(query_string="-",null(),query_string) | eval query_string=coalesce(query_string,uri_query) | rex field=query_string "(?i)(?:^|&)(?<query_param>[cp])=(?<query_value>[^&]*)" | eval query_param=lower(query_param), query_value=urldecode(replace(query_value,"\+","%20")) | where isnotnull(uri_only) AND isnotnull(query_param) | where (match(uri_only,"(?i)(^|/)GW/run$") OR match(uri_only,"(?i)/servlet/(WindchillGW|WindchillAuthGW)/GW/run$") OR match(uri_only,"(?i)(^|/)dpr_[0-9a-f]{8}\.jsp$")) AND (query_param="c" OR query_param="p") | where NOT (query_param="c" AND match(query_value,"(?i)^echo(\s|20)+GW_READY_OK$")) | eval activity=case(query_param="c","command_execution_parameter",query_param="p","file_read_parameter",true(),"unknown") | eval src=src_ip
| stats count min(_time) as firstTime max(_time) as lastTime values(log_level) as log_level values(logger) as logger values(http_method) as http_method values(status) as status values(uri_only) as uri_path values(query_string) as query_string by src activity query_param query_value
how_to_implement:To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
Update the `windchill_log4j` macro to include the appropriate index constraints for your environment.
The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers and parses embedded servlet URI, query parameter, source IP, HTTP method, and status fields.
known_false_positives:Requests to `GW/run` or randomly named `dpr_<8 hex>.jsp` files with `c=` or `p=` parameters should not be expected during normal Windchill operation.
Validate whether red-team testing, vulnerability scanning, or incident response replay generated the activity before closing as benign.
References: -https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability -https://nvd.nist.gov/vuln/detail/CVE-2026-4681 -https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03 drilldown_searches: name:'View the detection results for - "$src$"' search:'%original_detection_search% | search src = "$src$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$src$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['PTC Windchill Exploitation']
