SYSTEM code execution via junction-based file deletion

Link following in Trend Micro Apex One 2019 and Apex One as a Service allows local users to execute code as SYSTEM on Windows. In the Security Agent Damage Cleanup Engine, an attacker-created junction redirects a privileged driver's file-deletion operation to an attacker-chosen file. Exploitation requires low-privileged code execution on the endpoint; deletion of a protected file enables privilege escalation and arbitrary code execution as SYSTEM.