Trend Micro Apex Central RCE exploited in wild

Published29 March 2022 Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Trend Micro Apex Central products contain a critical vulnerability allowing remote arbitrary file upload and code execution, with active exploitation confirmed.

Sourceipa.go.jp — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

Japan's IPA has issued an alert regarding a critical vulnerability in Trend Micro Apex Central and Trend Micro Apex Central as a Service, both integrated security management products. The vulnerability allows remote attackers to upload arbitrary files and achieve code execution on affected systems. IPA reports that active exploitation has already been confirmed in the wild, raising significant concern for organizations running these products. The vendor has released security patches to address the issue. Given the confirmed exploitation and the critical nature of the flaw—affecting a security management platform that typically has elevated privileges and broad network visibility—IPA urges immediate patching to prevent further compromise.

Detection guidance

Suspicious Child Process Spawned by Trend Micro Apex Central Service

ATT&CK T1203 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects command interpreters or scripting engines spawned by Trend Micro Apex Central (Control Manager) server processes, consistent with exploitation of the Apex Central file-upload RCE vulnerability leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Trend Micro Apex Central
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Apex Central\
    - \Control Manager\
    - \TMCM\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks invoked by Apex
  Central service accounts
- Trend Micro support tools performing diagnostics through the management console
level: high
tags:
- attack.t1203
- attack.execution
id: 68bbe9b1-e974-5ac7-b149-e94db9c56c00
status: experimental
author: Vorant

Ingress Tool Transfer via LOLBins from Apex Central Process Tree

ATT&CK T1105 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects use of common living-off-the-land download utilities (certutil, bitsadmin, curl, powershell download cradles) executed by processes descending from the Trend Micro Apex Central service, indicating post-exploitation tool staging after RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LOLBin Download Activity from Apex Central Process Tree
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Apex Central\
    - \Control Manager\
    - \TMCM\
  selection_tools:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \powershell.exe
    - \pwsh.exe
  selection_download_args:
    CommandLine|contains:
    - -urlcache
    - -decode
    - /transfer
    - DownloadFile
    - DownloadString
    - Invoke-WebRequest
    - 'iwr '
    - -OutFile
  condition: selection_parent and selection_tools and selection_download_args
falsepositives:
- Administrator-initiated update or patch download scripts run through the console
- Endpoint management automation using certutil or bitsadmin for legitimate content
  distribution
level: high
tags:
- attack.t1105
- attack.command-and-control
id: b9c85ed5-da61-5f2c-abe9-91c9b416fc78
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20220330.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs