Trend Micro Apex One flaw exploited in wild
A directory traversal vulnerability in Trend Micro's OfficeScan/Apex One (ウイルスバスター コーポレートエディション) management console is being actively exploited to gain admin access.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
IPA (Japan's Information-technology Promotion Agency) issued an urgent alert regarding a directory traversal vulnerability in Trend Micro's corporate antivirus product (ウイルスバスター コーポレートエディション, known internationally as OfficeScan/Apex One). The flaw allows an attacker to log into the management console with administrator privileges and alter arbitrary settings, such as scan configurations.
The advisory states that exploitation has already been confirmed in the wild, and IPA warns that damage may spread further if organizations do not act quickly. Affected organizations are urged to apply the vendor-supplied patch immediately, with version-specific patch availability to be confirmed via the linked vendor resources.
Mentioned in this report
Detection guidance
Directory Traversal Pattern in Web Request to Security Product Management Console
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences aimed at web-based management consoles, consistent with exploitation of the Apex One/OfficeScan directory traversal authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Directory Traversal Pattern in Web Request to Management Console
logsource:
category: proxy
product: null
detection:
selection:
c-uri|contains:
- ../
- ..%2f
- ..%5c
- '%2e%2e%2f'
- '%2e%2e/'
filter:
c-uri|contains:
- /help/
- /docs/
condition: selection and not filter
falsepositives:
- Legitimate application testing or vulnerability scanning tools probing for traversal
issues
- Some web frameworks legitimately encode relative paths with dot-dot sequences in
query strings
level: medium
tags:
- attack.t1190
- attack.initial-access
id: d1bd1ca6-a8b6-51f6-9c9b-3e3e3988bc86
status: experimental
author: Vorant
Suspicious Child Process Spawned from Trend Micro Apex One/OfficeScan Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command interpreters or scripting engines launched as children of Trend Micro Apex One/OfficeScan server-side processes, consistent with post-exploitation command execution following abuse of the management console directory traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Apex One OfficeScan Server Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- \PccNTMon.exe
- \TmListen.exe
- \ntrtscan.exe
- \cgiWatchdog.exe
- \OfficeScanSvp.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \rundll32.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate Trend Micro update or maintenance scripts invoked by the server processes
- Administrative troubleshooting scripts triggered through vendor-supported hooks
level: high
tags:
- attack.t1190
- attack.execution
id: af6192e7-5fec-52f9-be4b-b04b9f3ead25
status: experimental
author: Vorant
New Administrator Account Created on Security Management Console Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a new local administrator account on a host running Trend Micro Apex One/OfficeScan server components shortly after suspected exploitation, consistent with an attacker establishing persistent valid-account access after bypassing console authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New Local Admin Account Created on AV Management Console Host
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains:
- user
- /add
selection_group:
CommandLine|contains:
- administrators
- /add
condition: selection and selection_group
falsepositives:
- Legitimate IT administration creating new accounts on the console host
- Scripted provisioning tools that manage local accounts as part of deployment
level: medium
tags:
- attack.t1078
- attack.persistence
id: cce9a81e-1edd-58a5-858c-e6e0a38a66f8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190910.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs