CVE-2026-67212: Trend Micro VPN OpenSSL DLL Search Path Hijacking — Local Privilege Escalation Detection and Remediation Guide

---
title: Trend Micro VPN Process Loading Module From User-Writable Path
id: 9d3e2c71-5a48-4b6f-9c21-7e4a5b8d6f01
status: experimental
description: Detects Trend Micro VPN components loading DLLs or OpenSSL providers/engines from user-writable directories, consistent with CVE-2026-67212 uncontrolled search path exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-577/
  - https://attack.mitre.org/techniques/T1574/001/
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_loader:
    Image|contains:
      - '\Trend Micro\'
      - '\TMVPN'
      - 'vpnclient'
  selection_module_path:
    ImageLoaded|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '\PerfLogs\'
  filter_signed_programfiles:
    ImageLoaded|contains:
      - '\Program Files\Trend Micro\'
      - '\Program Files (x86)\Trend Micro\'
      - '\Windows\System32\'
  condition: selection_loader and selection_module_path and not filter_signed_programfiles
falsepositives:
  - Rare legitimate plugin loads from ProgramData; verify signer and hash
level: high
---
title: OpenSSL Configuration File Created In Non-Standard Location
id: 4f7a1b92-8c3d-4e5a-b916-2d8f6a3c9e55
status: experimental
description: Detects creation of openssl.cnf or OpenSSL provider/engine configuration in user-writable directories, a staging artifact for CVE-2026-67212 exploitation against Trend Micro VPN.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-577/
  - https://attack.mitre.org/techniques/T1574/005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1574.005
logsource:
  category: file_event
  product: windows
detection:
  selection_name:
    TargetFilename|endswith:
      - '\openssl.cnf'
      - '\openssl.cfg'
      - 'engines.dll'
  selection_path:
    TargetFilename|contains:
      - '\Users\'
      - '\ProgramData\'
      - '\Windows\Temp\'
  filter_vendor_path:
    TargetFilename|contains:
      - '\Program Files\Trend Micro\'
      - '\Program Files (x86)\Trend Micro\'
  condition: selection_name and selection_path and not filter_vendor_path
falsepositives:
  - Developers installing local OpenSSL toolchains in their profile
level: medium
---
title: Elevated Service Process Spawned By Trend Micro VPN Executing Unsigned Child
id: b21c6d48-3f7e-4a90-8d5b-1c9e4a7f2b33
status: experimental
description: Detects Trend Micro VPN processes spawning unexpected command interpreters or scripting hosts, a potential post-exploitation indicator following successful privilege escalation via CVE-2026-67212.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-577/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Trend Micro\'
      - 'vpn'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor diagnostics or update routines invoking cmd.exe; confirm with Trend Micro release notes
level: high

// Hunt 1: Trend Micro VPN loading modules from user-writable paths (CVE-2026-67212)
let WritablePaths = dynamic(["\\Users\\Public\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Windows\\Temp\\", "\\ProgramData\\", "\\PerfLogs\\"]);
DeviceImageLoadEvents
| where FolderPath has_any ("Trend Micro", "TMVPN") or InitiatingProcessFolderPath has_any ("Trend Micro", "TMVPN")
| where FileName endswith ".dll" or FileName endswith ".cnf"
| where FolderPath has_any (WritablePaths)
| where FolderPath !has "Program Files"
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc;
// Hunt 2: Staged OpenSSL configuration files in writable locations
DeviceFileEvents
| where FileName =~ "openssl.cnf" or FileName endswith "engines.dll"
| where FolderPath has_any ("\\Users\\", "\\ProgramData\\", "\\Windows\\Temp\\")
| where FolderPath !has "Program Files"
| join kind=leftouter (DeviceProcessEvents | summarize by DeviceId, FileName=InitiatingProcessFileName, TimeGenerated) on DeviceId
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
// Hunt 3: VPN service spawning shells or recon utilities post-exploitation
DeviceProcessEvents
| where InitiatingProcessFolderPath has_any ("Trend Micro", "vpn")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "net.exe", "whoami.exe", "nltest.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, AccountName
| order by TimeGenerated desc;

-- Hunt for OpenSSL config staging and suspicious DLLs in user-writable paths (CVE-2026-67212)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/AppData/**/openssl.cnf',
  'C:/Users/Public/**/openssl.cnf',
  'C:/ProgramData/**/openssl.cnf',
  'C:/Windows/Temp/**/openssl.cnf',
  'C:/Users/*/AppData/**/engines.dll'
])

-- Correlate with running Trend Micro VPN processes and their loaded modules
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)trend.?micro|tmvpn|vpn'

# CVE-2026-67212 - Trend Micro VPN exposure audit and hardening verification
# Run elevated on each endpoint hosting Trend Micro VPN

$Report = [ordered]@{}

# 1. Locate Trend Micro VPN installation
$InstallPaths = @(
  "$env:ProgramFiles\Trend Micro",
  "${env:ProgramFiles(x86)}\Trend Micro"
) | Where-Object { Test-Path $_ }
$Report['TrendMicroInstalled'] = [bool]$InstallPaths

# 2. Check for OPENSSL_CONF environment variable abuse (user-controllable config path)
$Report['OPENSSL_CONF_Machine'] = [Environment]::GetEnvironmentVariable('OPENSSL_CONF','Machine')
$Report['OPENSSL_CONF_User']    = [Environment]::GetEnvironmentVariable('OPENSSL_CONF','User')
if ($Report['OPENSSL_CONF_User']) {
  Write-Warning "User-level OPENSSL_CONF set: $($Report['OPENSSL_CONF_User']) - potential hijack vector"
}

# 3. Audit ACLs on installation directory for write access by non-admins
foreach ($Path in $InstallPaths) {
  Get-ChildItem $Path -Directory -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $acl = Get-Acl $_.FullName
    $weak = $acl.Access | Where-Object {
      $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
      $_.FileSystemRights -match 'Write|Modify|FullControl' -and
      $_.AccessControlType -eq 'Allow'
    }
    if ($weak) {
      Write-Warning "WRITABLE BY NON-ADMINS: $($_.FullName) -> $($weak.IdentityReference -join ', ')"
    }
  }
}

# 4. Scan for planted OpenSSL config artifacts in writable locations
$SuspectFiles = Get-ChildItem -Path "$env:PUBLIC","$env:ProgramData","$env:windir\Temp","$env:LOCALAPPDATA" `
  -Recurse -Include 'openssl.cnf','openssl.cfg','engines.dll' -ErrorAction SilentlyContinue
$Report['SuspectArtifacts'] = $SuspectFiles.FullName

# 5. Check Trend Micro VPN product version against vendor advisory
$vpn = Get-WmiObject Win32_Product -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'Trend Micro.*VPN' }
$Report['InstalledVersion'] = $vpn.Version
$Report

# 6. Remediation action: remove rogue user-level OPENSSL_CONF if unauthorized
# [Environment]::SetEnvironmentVariable('OPENSSL_CONF',$null,'User')

Write-Host "`nACTION: Confirm installed version against ZDI-26-577 / Trend Micro advisory and apply the vendor update." -ForegroundColor Yellow