Exploitation for Priv-Esc × Trend Micro Deep Security Agent 20

command injection vulnerability in Trend Micro Deep Security Agent version 20 allows authenticated attackers with low privileges to escalate privileges

OS command injection in the manual scan feature of the Deep Security Agent. An attacker with low-privileged code execution on the target can inject arbitrary commands, leading to privilege escalation and remote code execution. In domain contexts, domain user privileges enable remote command injection to other agents.

Monitor process creation events for suspicious child processes spawned by the Trend Micro Deep Security Agent service (e.g., cmd.exe, powershell.exe) with command-line arguments indicative of injection (e.g., unusual concatenation, encoded commands). Mitigation: Apply vendor patch and restrict agent communication to trusted hosts only.