VORANT. Threat Intelligence Research Create a free account

Trend Micro Virus Buster exploit confirmed

Published Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Trend Micro Virus Buster Corporate Edition contains an actively exploited directory traversal vulnerability allowing unauthorized admin console access.

Sourceipa.go.jp — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

Japan's IPA has issued an alert regarding a directory traversal vulnerability in Trend Micro Virus Buster Corporate Edition (the Japanese market name for Trend Micro OfficeScan/Apex One). The vulnerability allows attackers to gain administrative access to the management console and modify arbitrary settings including search configurations.

The vulnerability is confirmed to be under active exploitation in the wild, with IPA warning that damage could expand rapidly. The agency is urging immediate application of vendor-provided patches across all affected versions.

This represents a supply-chain risk vector where enterprise antivirus infrastructure itself becomes the attack surface. Organizations using affected versions should prioritize patching given the confirmed exploitation and potential for lateral movement via compromised security management consoles.

Related reporting

Detection guidance

Directory Traversal Attempt Against Trend Micro OfficeScan/Apex One Management Console

ATT&CK T1190 · status experimental · needs null proxy logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects HTTP requests containing directory traversal sequences targeting Trend Micro OfficeScan/Apex One (Virus Buster) management console endpoints, consistent with the confirmed exploitation reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Directory Traversal Attempt Against Trend Micro OfficeScan Console
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains:
    - /officescan
    - /webclient
    - /officescanpc
    - /apex
    - /console
  filter:
    c-uri|contains:
    - /officescan/reports
    - /officescan/help
  condition: selection and not filter
falsepositives:
- Vulnerability scanning or penetration testing against the same console
- Legitimate administrative URLs that happen to contain encoded dot-dot sequences
  due to proxy rewriting
level: high
tags:
- attack.t1190
- attack.initial-access
id: 51b19cc9-3f2d-55d0-9805-80567015c728
status: experimental
author: Vorant
fields:
- c-uri
- c-ip
- cs-method

Suspicious Child Process Spawned by Trend Micro OfficeScan/Apex One Service

ATT&CK T1548 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects command shells or scripting engines spawned by Trend Micro OfficeScan/Apex One (Virus Buster) management/service processes, indicating abuse of the compromised management console to gain administrative code execution as reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process From Trend Micro OfficeScan Service
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - OfficeScan
    - Apex One
    - PccNT
    - TmListen
    - TMBMSRV
    - CNTAoSMgr
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\net.exe
    - \\rundll32.exe
  filter:
    CommandLine|contains:
    - ScanNow
    - PatternUpdate
  condition: selection and not filter
falsepositives:
- Legitimate scheduled maintenance scripts invoked by the antivirus management service
- Administrator-initiated remote command execution through the sanctioned console
  interface
level: high
tags:
- attack.t1548
- attack.privilege-escalation
id: 9eb2ab5a-7c9d-5c1d-84ee-3b2a6318cc76
status: experimental
author: Vorant

Unexpected Modification of Trend Micro OfficeScan/Apex One Configuration Files

ATT&CK T1548 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects changes to Trend Micro OfficeScan/Apex One (Virus Buster) configuration files made by a process other than the expected management service binaries, consistent with unauthorized settings modification via the exploited console reported by IPA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unexpected Process Modifying Trend Micro OfficeScan Configuration
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \\OfficeScan\\
    - \\Apex One\\
    TargetFilename|endswith:
    - .ini
    - .xml
    - .cfg
  filter:
    Image|contains:
    - TMBMSRV.exe
    - TmListen.exe
    - PccNTMon.exe
    - CNTAoSMgr.exe
  condition: selection and not filter
falsepositives:
- Legitimate configuration backup or restore tools accessing the same directory
- Endpoint management software that legitimately updates OfficeScan configuration
  outside the normal service context
level: medium
tags:
- attack.t1548
id: 3458c9c9-543e-53bf-9fca-19a0b8ef12aa
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190910.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs