# Trend Micro Apex One flaw exploited in wild

Published: 2019-09-09 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/c543591b-63b4-52a1-a777-0b09573b3a44/trend-micro-apex-one-flaw-exploited-in-wild

> A directory traversal vulnerability in Trend Micro's OfficeScan/Apex One (ウイルスバスター コーポレートエディション) management console is being actively exploited to gain admin access.

IPA (Japan's Information-technology Promotion Agency) issued an urgent alert regarding a directory traversal vulnerability in Trend Micro's corporate antivirus product (ウイルスバスター コーポレートエディション, known internationally as OfficeScan/Apex One). The flaw allows an attacker to log into the management console with administrator privileges and alter arbitrary settings, such as scan configurations.

The advisory states that exploitation has already been confirmed in the wild, and IPA warns that damage may spread further if organizations do not act quickly. Affected organizations are urged to apply the vendor-supplied patch immediately, with version-specific patch availability to be confirmed via the linked vendor resources.

## Mentioned in this report

- Vulnerabilities: CVE-2019-9489

## Detection guidance (public sample)

### Directory Traversal Pattern in Web Request to Security Product Management Console

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences aimed at web-based management consoles, consistent with exploitation of the Apex One/OfficeScan directory traversal authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Directory Traversal Pattern in Web Request to Management Console
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains:
    - ../
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e/'
  filter:
    c-uri|contains:
    - /help/
    - /docs/
  condition: selection and not filter
falsepositives:
- Legitimate application testing or vulnerability scanning tools probing for traversal
  issues
- Some web frameworks legitimately encode relative paths with dot-dot sequences in
  query strings
level: medium
tags:
- attack.t1190
- attack.initial_access
id: d1bd1ca6-a8b6-51f6-9c9b-3e3e3988bc86
status: experimental
author: Vorant
```

### Suspicious Child Process Spawned from Trend Micro Apex One/OfficeScan Server Process

ATT&CK: T1190

Detects command interpreters or scripting engines launched as children of Trend Micro Apex One/OfficeScan server-side processes, consistent with post-exploitation command execution following abuse of the management console directory traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Apex One OfficeScan Server Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \PccNTMon.exe
    - \TmListen.exe
    - \ntrtscan.exe
    - \cgiWatchdog.exe
    - \OfficeScanSvp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Trend Micro update or maintenance scripts invoked by the server processes
- Administrative troubleshooting scripts triggered through vendor-supported hooks
level: high
tags:
- attack.t1190
- attack.execution
id: af6192e7-5fec-52f9-be4b-b04b9f3ead25
status: experimental
author: Vorant
```

### New Administrator Account Created on Security Management Console Host

ATT&CK: T1078

Detects creation of a new local administrator account on a host running Trend Micro Apex One/OfficeScan server components shortly after suspected exploitation, consistent with an attacker establishing persistent valid-account access after bypassing console authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: New Local Admin Account Created on AV Management Console Host
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains:
    - user
    - /add
  selection_group:
    CommandLine|contains:
    - administrators
    - /add
  condition: selection and selection_group
falsepositives:
- Legitimate IT administration creating new accounts on the console host
- Scripted provisioning tools that manage local accounts as part of deployment
level: medium
tags:
- attack.t1078
- attack.persistence
id: cce9a81e-1edd-58a5-858c-e6e0a38a66f8
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190910.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c543591b-63b4-52a1-a777-0b09573b3a44/trend-micro-apex-one-flaw-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup