Trend Micro Apex One and Vision One privilege escalation flaws

Suspicious Child Process Spawned by Trend Micro Apex One / Vision One Service Binaries

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects command shells or scripting engines spawned from Trend Micro Apex One/Vision One endpoint security processes, which may indicate exploitation of privilege escalation vulnerabilities (e.g. CVE-2026-34926) against the security agent. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Trend Micro Apex One Service
id: 97dc96b6-a2e8-5485-bab8-ee5f6c855b42
status: experimental
description: 'Detects cmd.exe, powershell.exe, or other command interpreters being
  spawned as a child process of Trend Micro Apex One or Vision One Endpoint Security
  service binaries. Legitimate Apex One processes rarely spawn interactive shells;
  this pattern can indicate exploitation of a privilege escalation vulnerability (e.g.
  CVE-2026-34926) that abuses the elevated privileges these security products hold.

  '
references:
- https://www.cert.ssi.gouv.fr
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Trend Micro\
    - TmListen.exe
    - Ntrtscan.exe
    - TmCCSF.exe
    - TmProxy.exe
    - ApexOne
    - PccNTMon.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_updates:
    CommandLine|contains:
    - ConsoleClient
    - /silent
    - TMUpdate
  condition: selection_parent and selection_child and not filter_updates
falsepositives:
- Legitimate Apex One update or maintenance tasks that invoke helper scripts
- Administrative troubleshooting scripts executed via Apex One management console
level: medium