Siemens Says Desigo CC Patches Are Falsely Flagged as Malware
Summary
Siemens says antivirus engines are incorrectly flagging Desigo CC versions 7–9 patch files. It suspects a compiled PowerShell script triggers detections and says file comparisons and signature checks found no signs of malicious modification.
Key points
- Multiple antivirus engines flagged patch files for Desigo CC versions 7 through 9; tests on VirusTotal also showed detections.
- Siemens suspects a compiled PowerShell script in the patches’ “patchHelper” is triggering the alerts.
- The script performs file system operations and registry modifications and runs with elevated privileges.
- Siemens says it compared the relevant files with development repositories and verified their digital signatures, finding no signs of malicious modification.
- Siemens is working with cybersecurity vendors to address the inaccurate classifications.
Article Details
- Event Type
- False-positive malware detections affecting Desigo CC patch files
- Impact
- Antivirus engines are incorrectly flagging patch files for Desigo CC versions 7 through 9 as malicious. Siemens reports that the files were checked against development repositories, showed no malicious modifications, and had valid digital signatures.