Detect Trend Micro Apex One Directory Traversal Exploitation (CVE-2026-34926) in IBM QRadar
Detects exploitation attempts targeting CVE-2026-34926, a directory traversal vulnerability (CWE-23) in Trend Micro Apex One (On-Premise). This KEV-listed vulnerability allows unauthenticated or low-privileged attackers to traverse directory boundaries via crafted HTTP requests to the Apex One management server, potentially enabling arbitrary file read or write operations. Active exploitation has been observed in the wild.
MITRE ATT&CK
QRadar Detection Query
SELECT
sourceip,
destinationip,
URL,
'HTTP Request Method' AS http_method,
'HTTP Response Code' AS http_status,
"userName",
LOGSOURCENAME(logsourceid) AS log_source,
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Trend Micro Apex One')
AND (
URL ILIKE '%..%2F%'
OR URL ILIKE '%..%5C%'
OR URL ILIKE '%2e%2e%2f%'
OR URL ILIKE '%252e252e%'
OR URL ILIKE '%..../%'
)
AND (
URL ILIKE '%officescan%'
OR URL ILIKE '%apex_one%'
OR URL ILIKE '%widget%'
OR URL ILIKE '%ServerMigration%'
)
AND LAST 7 DAYS
GROUP BY sourceip, URL
HAVING COUNT(*) >= 2
ORDER BY COUNT(*) DESCQRadar AQL query detecting directory traversal exploitation of Trend Micro Apex One by querying IIS and Apex One log sources for encoded traversal sequences in known vulnerable URL paths.
Data Sources
Required Tables
False Positives & Tuning
- Automated compliance scanners performing scheduled CIS benchmark checks against web services
- Internal monitoring systems that legitimately query Apex One management API with URL-encoded parameters
- Load balancers or WAFs that modify URL encoding before logging
Other platforms for CVE-2026-34926
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic Directory Traversal Probe Against Apex One CGI Endpoint
Expected signal: IIS access log entry with traversal sequence in cs-uri-query field, HTTP response code indicating success (200) or path not found (404). Network connection event from test host to Apex One server on port 4343.
- Test 2Double-Encoded Traversal Bypass Attempt
Expected signal: Multiple IIS access log entries with different traversal encoding variants. Possible WAF alert if WAF is deployed. Network events showing rapid sequential HTTP requests to Apex One from the same source IP.
- Test 3Windows Apex One Traversal Simulation via PowerShell
Expected signal: Windows Security Event Log entry for PowerShell execution (Event ID 4688 or Sysmon Event ID 1). Network connection events from the Windows test host to Apex One server port 4343. IIS access log entries on Apex One server matching traversal patterns.
Unlock Pro Content
Get the full detection package for CVE-2026-34926 including response playbook, investigation guide, and atomic red team tests.