Trend Micro Virus Buster exploit confirmed

9 September 2019 critical vulnerability

Trend Micro Virus Buster Corporate Edition contains an actively exploited directory traversal vulnerability allowing unauthorized admin console access.

Japan's IPA has issued an alert regarding a directory traversal vulnerability in Trend Micro Virus Buster Corporate Edition (the Japanese market name for Trend Micro OfficeScan/Apex One). The vulnerability allows attackers to gain administrative access to the management console and modify arbitrary settings including search configurations.

The vulnerability is confirmed to be under active exploitation in the wild, with IPA warning that damage could expand rapidly. The agency is urging immediate application of vendor-provided patches across all affected versions.

This represents a supply-chain risk vector where enterprise antivirus infrastructure itself becomes the attack surface. Organizations using affected versions should prioritize patching given the confirmed exploitation and potential for lateral movement via compromised security management consoles.

Detection guidance

Directory Traversal Attempt Against Trend Micro OfficeScan/Apex One Management Console

ATT&CK T1190

Detects HTTP requests containing directory traversal sequences targeting Trend Micro OfficeScan/Apex One (Virus Buster) management console endpoints, consistent with the confirmed exploitation reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Directory Traversal Attempt Against Trend Micro OfficeScan Console
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains:
    - /officescan
    - /webclient
    - /officescanpc
    - /apex
    - /console
  filter:
    c-uri|contains:
    - /officescan/reports
    - /officescan/help
  condition: selection and not filter
  fields:
  - c-uri
  - c-ip
  - cs-method
falsepositives:
- Vulnerability scanning or penetration testing against the same console
- Legitimate administrative URLs that happen to contain encoded dot-dot sequences
  due to proxy rewriting
level: high
tags:
- attack.t1190
- attack.initial_access
id: 51b19cc9-3f2d-55d0-9805-80567015c728
status: experimental
author: Vorant

Suspicious Child Process Spawned by Trend Micro OfficeScan/Apex One Service

ATT&CK T1548

Detects command shells or scripting engines spawned by Trend Micro OfficeScan/Apex One (Virus Buster) management/service processes, indicating abuse of the compromised management console to gain administrative code execution as reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process From Trend Micro OfficeScan Service
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - OfficeScan
    - Apex One
    - PccNT
    - TmListen
    - TMBMSRV
    - CNTAoSMgr
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\net.exe
    - \\rundll32.exe
  filter:
    CommandLine|contains:
    - ScanNow
    - PatternUpdate
  condition: selection and not filter
falsepositives:
- Legitimate scheduled maintenance scripts invoked by the antivirus management service
- Administrator-initiated remote command execution through the sanctioned console
  interface
level: high
tags:
- attack.t1548
- attack.privilege_escalation
id: 9eb2ab5a-7c9d-5c1d-84ee-3b2a6318cc76
status: experimental
author: Vorant

Unexpected Modification of Trend Micro OfficeScan/Apex One Configuration Files

ATT&CK T1548

Detects changes to Trend Micro OfficeScan/Apex One (Virus Buster) configuration files made by a process other than the expected management service binaries, consistent with unauthorized settings modification via the exploited console reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unexpected Process Modifying Trend Micro OfficeScan Configuration
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \\OfficeScan\\
    - \\Apex One\\
    TargetFilename|endswith:
    - .ini
    - .xml
    - .cfg
  filter:
    Image|contains:
    - TMBMSRV.exe
    - TmListen.exe
    - PccNTMon.exe
    - CNTAoSMgr.exe
  condition: selection and not filter
falsepositives:
- Legitimate configuration backup or restore tools accessing the same directory
- Endpoint management software that legitimately updates OfficeScan configuration
  outside the normal service context
level: medium
tags:
- attack.t1548
- attack.defense_evasion
id: 3458c9c9-543e-53bf-9fca-19a0b8ef12aa
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190910.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free