Trend Micro Apex One Directory Traversal Exploitation (CVE-2026-34926)

union DeviceNetworkEvents, W3CIISlogs, AzureDiagnostics
| where TimeGenerated > ago(7d)
| where (
    (RequestUri has "..%2F" or RequestUri has "..%5C" or RequestUri has "%2e%2e%2f" or RequestUri has "%2e%2e/" or RequestUri has "....//" or RequestUri has "..%252F")
    and (RequestUri contains "/officescan" or RequestUri contains "/apex_one" or RequestUri contains "/OfficeScan" or RequestUri contains "/widget" or RequestUri contains "/ServerMigration")
)
| extend TraversalDepth = countof(RequestUri, "..")
| where TraversalDepth >= 2
| project TimeGenerated, RemoteIP, RequestUri, HttpMethod, HttpStatusCode, UserAgent, TraversalDepth
| order by TimeGenerated desc

index=web OR index=iis OR index=proxy sourcetype=iis OR sourcetype=access_combined OR sourcetype=pan:traffic
| eval uri=coalesce(cs_uri_stem, uri_path, request)
| eval query=coalesce(cs_uri_query, uri_query, "")
| eval full_uri=uri."?".query
| where (match(full_uri, "(\.\.|%2e%2e|%252e%252e|\.\.%2f|\.\.\/|\.\.%5c)") AND match(uri, "(?i)(\/officescan|\/apex_one|\/OfficeScan|\/widget\/widgetMeta\.php|\/ServerMigration|\/ServerName)"))
| eval traversal_depth=mvcount(split(full_uri, ".."))-1
| where traversal_depth >= 2
| stats count AS attempt_count, values(full_uri) AS traversal_uris, values(status) AS response_codes, dc(clientip) AS unique_src BY clientip, host, _time
| sort -attempt_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   url.path : ("*/officescan/*", "*/OfficeScan/*", "*/apex_one/*", "*/widget/*", "*/ServerMigration/*") and
   (
     url.path : ("*..%2F*", "*..%5C*", "*%2e%2e%2f*", "*%252e*", "*....%2F*") or
     url.original : ("*../..*/", "*..%2F..%2F*")
   )
  ] with runs=2

SELECT
  sourceip,
  destinationip,
  URL,
  'HTTP Request Method' AS http_method,
  'HTTP Response Code' AS http_status,
  "userName",
  LOGSOURCENAME(logsourceid) AS log_source,
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Trend Micro Apex One')
  AND (
    URL ILIKE '%..%2F%'
    OR URL ILIKE '%..%5C%'
    OR URL ILIKE '%2e%2e%2f%'
    OR URL ILIKE '%252e252e%'
    OR URL ILIKE '%..../%'
  )
  AND (
    URL ILIKE '%officescan%'
    OR URL ILIKE '%apex_one%'
    OR URL ILIKE '%widget%'
    OR URL ILIKE '%ServerMigration%'
  )
  AND LAST 7 DAYS
GROUP BY sourceip, URL
HAVING COUNT(*) >= 2
ORDER BY COUNT(*) DESC

_sourceCategory=web/iis OR _sourceCategory=web/apache OR _sourceCategory=security/apex_one
| parse regex "(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?(?<method>GET|POST|PUT|DELETE|HEAD|OPTIONS)\s+(?<uri>\S+)\s+HTTP" nodrop
| where (uri matches "*..%2F*" or uri matches "*..%5C*" or uri matches "*%2e%2e%2f*" or uri matches "*%252e*") and (uri matches "*officescan*" or uri matches "*apex_one*" or uri matches "*OfficeScan*" or uri matches "*widget*" or uri matches "*ServerMigration*")
| count as attempt_count by client_ip, uri, method
| where attempt_count >= 2
| sort by attempt_count desc
| fields client_ip, uri, method, attempt_count

rule cve_2026_34926_apex_one_directory_traversal {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects directory traversal exploitation of Trend Micro Apex One CVE-2026-34926"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-34926"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.network.http.method != ""
    (
      re.regex($req.network.http.request_url, `(?i)(\.\.|%2e%2e|%252e|\.\.%2f|\.\.%5c)`) and
      re.regex($req.network.http.request_url, `(?i)(\/officescan|\/apex_one|\/OfficeScan|\/widget|\/ServerMigration)`)
    )

  match:
    $req.principal.ip over 5m

  condition:
    #req >= 2
}

#event_simpleName=NetworkReceiveAcceptIPv4 OR #event_simpleName=NetworkReceiveAcceptIPv6
| HttpPath matches regex "(?i)(\.\.|%2e%2e|%252e|\.\.%2f|\.\.%5c)"
| HttpPath matches regex "(?i)(\/officescan|\/apex_one|\/OfficeScan|\/widget|\/ServerMigration)"
| groupby([RemoteAddressIP4, HttpPath, HttpMethod], function=[count(aid, as=RequestCount), collect(HttpStatusCode)])
| RequestCount >= 2
| sort(RequestCount, order=desc)