Trend Micro Apex Central flaw exploited in wild

29 March 2022 high vulnerability technology

A file-upload vulnerability in Trend Micro Apex Central is being actively exploited to achieve remote code execution.

Japan's IPA issued an alert regarding a vulnerability in Trend Micro Apex Central and Apex Central as a Service, an integrated security management product. The flaw allows a remote attacker to upload arbitrary files, which can subsequently be leveraged to execute arbitrary code on affected systems.

Mentioned in this report

Vulnerabilities CVE-2022-26871KEV

Detection guidance

Suspicious Child Process Spawned from Java-based Web Application (Possible Apex Central Exploitation)

ATT&CK T1190

Detects a shell or scripting interpreter spawned as a child of a Java/Tomcat web-server process, consistent with remote code execution following an arbitrary file upload exploit such as the Trend Micro Apex Central vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Shell Spawned from Java Web Server Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
    - \tomcat9.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \rundll32.exe
  filter_common_admin:
    CommandLine|contains:
    - catalina
    - setclasspath
  condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate administrative scripts invoked by Tomcat startup/shutdown wrappers
- Java-based management tools that intentionally shell out for local system checks
level: high
tags:
- attack.t1190
- attack.execution
id: 54b8c331-f5e1-5f18-87b0-d6201fc37509
status: experimental
author: Vorant

Webshell-like Script File Dropped in Web Application Directory

ATT&CK T1190

Detects creation of script or archive files (jsp, war, php, aspx) inside a web application directory, indicating a possible webshell dropped via an arbitrary file upload vulnerability such as the one affecting Trend Micro Apex Central. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Created in Web Application Directory
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \webapps\
    - \wwwroot\
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .war
    - .php
    - .aspx
  filter_deployment:
    TargetFilename|contains:
    - \ROOT\WEB-INF\lib\
  condition: selection and not filter_deployment
falsepositives:
- Legitimate application deployment or update of war/jsp files by administrators
- Automated build/CI pipelines deploying updated web application packages
level: medium
tags:
- attack.t1190
- attack.persistence
id: b7bfb0d6-4c2a-53f3-8b0d-6362f371de84
status: experimental
author: Vorant

Reconnaissance Commands Executed by Web Server Process

ATT&CK T1190

Detects common post-exploitation reconnaissance commands (whoami, net user, systeminfo) executed by a process whose parent is a web server or Java application server process, suggesting successful exploitation of a public-facing application such as Apex Central. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Executed by Web Server Child Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
    - \w3wp.exe
    - \httpd.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - systeminfo
    - ipconfig
    - tasklist
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or monitoring scripts that gather system information through the web
  server account
- Administrative diagnostic scripts scheduled to run under the service account
level: high
tags:
- attack.t1190
- attack.discovery
id: 393c7c63-afdd-5cd9-bf75-b1cf904c10c7
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20220330.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free