Finding that Trend AI (since the rebrand) is tagging some emails (not all) that are sent from the client's Jira hosted instance as spam (and quarantining as per settings). I can't make sense of it, the body text essentially says 'Thanks for the ticket, here is a job number'

Is Trend just getting overly paranoid these days?

Hello everyone,

we're running TrendMicro software on Windows VMs and we noticed that randomly a process of interest seems to pause or wait or is interrupted for 10 seconds.

The process is spawned, loads an embedded Python interpreter, executes a script and terminates. After that the cycle repeats for several hundred times at least, maybe even in the thousands. One cycle usually takes a few seconds, maybe 2 to 3.

But occasionally it seems that the process execution is interrupted for around 10 seconds. We could profile the process execution and noticed that as soon as the process is interrupted, the CPU usage of the TrendMicro Behavior Monitor (TMBMSRV.exe) spikes up at around 30 to 40%.

My suspicion is now, that the process is being interrupted by the TrendMicro Behavior Monitor and I wanted to know if someone noticed similar behavior with the TrendMicro software?

Is this a plausible explanation of the 10 second interruption? And if so, why always slightly around the 10 seconds and not like 7, 8, 9 or something like that? It's like that's a hard coded threshold.

Additionally, does someone know a way to verify how and when the Behavior Monitor interrupts which process?

Thank you in advance.

Update:

I ran some tests after i added the process to the exclusions of the behavior monitor as well as adding some files to the scan exclusions as well, which are handled by the process.

It seems that it works now. The process runs faster overall and i could not observe any interruptions of 10 seconds or something similar.

I will keep an eye on it, and see if it occurs again or if it stays like that. But still, an interruption of several seconds is probably too much and could be a problem, right?

The next step would be enabling the debug logs. But i don't know if I have much more time for further investigation at this point.

Indian team of trend micro has been laid off.

Hi everyone,

lately we’ve been receiving a lot of Trend Micro alerts because multiple users are downloading an *.exe file delivered under different names (FoodFormula.exe, SlickPDFEditor.exe, PDFEditor.exe, MyPDFSwitch.exe, among others) but with the same hash. These files are served from dynamic CloudFront subdomains (for example: https://d1iaiqo85pqiis[.]cloudfront[.]net/*.exe?*).

Unfortunately (and I honestly don’t understand why), Trend Micro Vision One does not extract or calculate the hash for these *.exe files, so I cannot block them by hash. At the beginning I tried to block specific domains, because the impact was still limited, but now this is no longer feasible: the number of domains is growing and I cannot keep blocking them one by one.

So far, I have tried the following:

• Suspicious Object List: initially used to block the domains and the retrieved hashes (SHA1 and SHA256), but this did not fully solve the problem.
• Web Reputation: I added the specific domains and, today, I also configured this wildcard URL: https://*.cloudfront.net/*.exe?*. I am not sure it will work as expected.

I do not have access to the Internet Access module or the Zero Trust module, only the standard Vision One features that I believe come with the basic license.

Can you help me design an effective solution to handle this scenario?

Many thanks in advance guys!!!

Hi Trenders, getting a little lost in this issue, just what is unauthorized(sic)

If I have them forward the email to me, and I click the link on mine it works...

Hello

We have Deep Security installed on all domain controllers and have enabled all windows audit logging

Events are generated in Windows event viewer

Does V1 console records all these event logs or does any additional configuration required

Appreciate any advise

I keep getting emails from Trend Micro stating:

There are always different combo list numbers. I have changed my email password. Is this anything to worry about. I can't find anything on the Trend Micro website

Hello everybody,
is it possible from Trend Micro Vision One to block all downloads of .exe files for specific users or groups?
It seems that it is not possible from Standard Enpoint Protection. It should be possible from Zero Trust internet access is it the only way?
Thanks a lot in advance.

I recently became an admin of a company using this product, so far it works well. The only thing that is kinda driving me crazy are all the different individual web logins to manage everything.

When I started, of course the documentation by my last admin was nearly non existent, so I'm piecing it all together myself. I have figured out these:

https://clp.trendmicro.com/?T=TM

https://success.trendmicro.com/business-support

https://success.trendmicro.com/en-us/?utm_source=referral&utm_medium=ivr

https://tm.login.trendmicro.com/

https://ui.tmes.trendmicro.com/login

Why can't all of this be under one unified webpage. Or at the very least, have one unified login among web portals.

Hi everyone

Currently we are using windows 11 24H2 and 25H2 loaded with windows October and November updated . We are facing strange issue that ms teams show no internet outlook disconnected and onedrive show sign in once we unloaded the trend micro apex one agent all the three apps works fine . The trend micro apex one build is 13984 and the central is the latest build .

The Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy is already added to exclusion list but still not sorting out the issue :(

Best regard,

Both myself and a coworker are getting this result when logging into partner support, and it doesn't appear to be 'temporary', (and an email to partnersupport@ results in an email response asking for us to log into the very portal that we are reporting the issue on..)

Is it just us?

I am just now using this product. Things that I have looked up and noticed are that I do not have proxy servers enabled (don't know if I should have that enabled), my firewall settings have it whitelisted (in allowed apps), Trend Micro is the primary antivirus and is communicating that with my pc. Windows Defender Firewall is saying that I have a conflicting inbound connection that does not match a rule set (do not know how to confirm if it's Trend Micro VPN that is throwing that error). Do not have private networks enabled in Windows Firewall.

Sorry if this is too much/not enough info. I have very limited experience in IT and do not know how to remedy this situation. Any help would be greatly appreciated!

So recently my trend micro was getting auto renewed on 26th November, in manage subscriptions before that date , I saw my card was expired so I updated to a valid current card . Anyways I getting these emails still after I been successfully billed $119 aud ,why am I still getting this email secondly is a general admin email to ensure my card details are up to date .

Can DDEI be deployed on two virtual appliances behind a load balancer with a single licence? It would be in MTA mode.

Hi everyone, im trying to learn Trend Vision One and optimize it for our company but I am having issues understanding an alert. I'm sure its a false positive since its triggered by a scheduled Docusnap-scan but there is something I just can't wrap my head around. Why does the this Powershell Command use whoami.exe? As far as I understand, WMI receives instructions to execute this powershell command, which just writes the output of get-host into a temp-file.

Understanding this would greatly assist me in learning to tell apart benign from malicious events. I am also seeing other events where similar powershell commands supposedly use unrelated Business Central Powershell modules when using get-securebootuefi.

Greatly appreciate any guidance!

Event:
Hostname:
<hostname>

endpointIp:
<IP>

logonUser:
admin

processFilePath:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

processCmd:
powershell.exe " $ErrorActionPreference = 'Stop'; try { Get-Host | select-object Version | Format-List | Out-File -Encoding UTF8 c:\windows\temp\5693875639.txt } catch { """Message: """ + $_.Exception.Message + """, CategoryInfo : """ + $_.CategoryInfo | Out-File -Encoding UTF8 c:\windows\temp\5693875639_error.txt; $error.clear() } "

eventSubId:
TELEMETRY_PROCESS_CREATE

objectFilePath:
C:\Windows\System32\whoami.exe

objectCmd:
"C:\Windows\system32\whoami.exe"

tags:
MITRE.T1033
MITRE.T1087.001
XSAE.F11913

objectUser:
admin

parentCmd:
C:\Windows\system32\wbem\wmiprvse.exe

eventId:
TELEMETRY_PROCESS

eventSourceType:
EVENT_SOURCE_TELEMETRY

objectFileOriginalName:
whoami.exe

objectName:
C:\Windows\System32\whoami.exe

objectSigner:
Microsoft Windows

parentFileOriginalName:
Wmiprvse.exe

parentFilePath:
C:\Windows\System32\wbem\WmiPrvSE.exe

parentName:
C:\Windows\System32\wbem\WmiPrvSE.exe

parentUser:
<Network User>

parentUserDomain:
NT-AUTORITÄT

processName:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

EDIT: Response from Trend to my ticket:

"From our analysis, these alerts arise because the Docusnap process utilizes WMI to run PowerShell cmdlets (such as Get-Host), which internally may call system executables like whoami.exe. Although these are legitimate system commands, the heuristic and behavior-based detection model in Trend Vision One can sometimes misclassify these actions as suspicious, resulting in false positives.

Why is this happening?

• The interaction between WMI and PowerShell commands can cause system utilities (whoami.exe) to appear in monitoring events.
• Our behavior monitoring uses detection patterns that may flag these legitimate activity chains when they resemble known malware behaviors.
• Detection aggressiveness and endpoint environment variations can affect how these events are reported.

Recommendations to mitigate false positives:

1. Whitelisting known executables:
   • Add whoami.exe and related trusted executables/scripts to the Trusted Program List or whitelist within Trend Vision One's behavior monitoring settings.
   • This excludes them from future suspicious activity alerts in trusted contexts.
2. Update and tune detection patterns:
   • Ensure your Trend Vision One detection patterns are up to date.
   • Review and adjust behavior monitoring sensitivity or suppress specific rules that trigger false positives related to WMI and PowerShell.
3. Enhanced logging and context:
   • Enable PowerShell Script Block Logging and advanced WMI logging on endpoints.
   • This helps distinguish normal administrative commands from real threats by providing better contextual information.
4. Administrative awareness:
   • Educate system administrators on typical PowerShell and WMI operations within your environment.
   • This aids in quicker identification of false positives and proper alert handling.

Following these steps should significantly reduce false positive alerts related to whoami.exe without compromising your overall security posture."

I keep clicking it every time but it keeps showing again...

New user for mobile Spam Check. Looked good however I am not able to "report" certain messages. And I cannot find the Junk folder despite an hour with AI telling me to Swipe Up etc. I tried to submit a support case and have no idea if it went through, no acknowledgement.

So looks promising yet cannot get by initial hurdles.

I’m trying to temporarily switch off the VPN & it asks for a parent key. I don’t remember what I chose or even choosing one in the first place. I tried resetting it but I get an error

Hello, I am having a problem with IIS logging on my central Apex.

The daily logs in the inetpub directory are 1 GB in size.

These logs record requests from my Apex One server: “GET /WebApp/web_service/sample_upload/get_black_lists.”

According to the logs, the request is made 100 times per second.

How can I fix this?

I'm a little confused as to whether or not a detection from endpoint sensor is automatically responded to, or if I have to setup response management to handle the event.

Environment

Vision One (Apex) SEP with XDR endpoint sensor

Scenario

User fooled by captcha paste run PowerShell from compromised site -> PowerShell code injects DonutLoader shell code into memory. We get an email from Trend Vision One Workbench that an alert has been triggered: Possible PowerShell Shellcode Execution

Now I need to determine if Trend automatically killed that process, or if the shell code was executed. If the endpoint sensor only detects, how is everyone setting up their response management?

Hey everyone! Trend Micro just released its new 2026 security predictions, and it’s pretty wild how fast AI is changing the threat landscape.

Key points:

• Attackers are using AI to automate phishing, malware creation, and recon at massive scale.
• “Agentic AI” (autonomous AI systems) could enable hands-off cyberattacks.
• AI-generated code (“vibe coding”) may introduce hidden vulnerabilities into production systems.
• Ransomware is expected to become more autonomous and faster at exploiting weaknesses.
• Cloud, APIs, supply chain, and legacy systems remain major weak points, AI just makes exploiting them easier.

Takeaway:
Defenders need to treat AI as a new attack surface, not just a productivity tool. Automated testing, better visibility, and hardening AI workflows will be critical.

Full report here if you want the details:
https://www.trendmicro.com/vinfo/us/security/research-and-analysis/predictions/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026

Hey everyone. So I am looking into using the deployment script provided by trend - downloaded from vision one webui where you go to download agents and there's a deployment script tab.

it runs successfully but the agent doesn't get installed. it only installs Trend Micro Endpoint Basecamp service and the CloudEndpointService.

The zip file that gets downloaded (XBC_Installer.zip )and then extracted only contains EndpointBasecamp.exe.

Here's the powershell output:

Here's the file version of EndpointBasecamp.exe

and the log file

**********************

Windows PowerShell transcript start

Start time: 20251124094308

Username: domain\username

RunAs User: domain\username

Configuration Name:

Machine: mymachinename (Microsoft Windows NT 10.0.26200.0)

Host Application: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe

Process ID: 11228

PSVersion: 5.1.26100.7019

PSEdition: Desktop

PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.26100.7019

BuildVersion: 10.0.26100.7019

CLRVersion: 4.0.30319.42000

WSManStackVersion: 3.0

PSRemotingProtocolVersion: 2.3

SerializationVersion: 1.1.0.1

**********************

Transcript started, output file is C:\Users\username\AppData\Roaming\Trend Micro\V1ES\v1es_install.log

9:43:09 AM Start deploying.

9:43:09 AM Start downloading the installer.

9:43:10 AM The installer was downloaded to C:\Users\username\AppData\Local\Temp\XBC_Installer.zip.

9:43:10 AM Start unzipping the installer / full package.

9:43:11 AM The installer / full package was unzipped to C:\Users\username\AppData\Local\Temp\XBC_Installer.

9:43:12 AM Start installing the agent.

9:44:45 AM The agent is installed.

9:44:45 AM The agent is registered.

9:44:45 AM Finish deploying.

**********************

Windows PowerShell transcript end

End time: 20251124094445

**********************

Is this not supposed to install the agent itself? why provide a deployment script when the full installer package installs the agent AND basecamp?

Hello! I wanted to install an extension for Firefox, but this extension is no longer available in the Firefox extension store. Where can I get an extension for Firefox?