{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "BeyondTrust CVE-2026-102764 is a critical authentication bypass in the CISA KEV catalog. Compromised appliances provide attackers with persistent, privileged remote access to the internal network." }, "name": "BeyondTrust Appliance Compromise and Execution", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1059", "defense evasion", "execution", "initial access", "lateral movement", "persistence" ], "series": { "slug": "cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support", "index": 1, "title": "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support", "total": 2 }, "related": [ { "hunt": "beyondtrust-persistence-manipulation", "reason": "This hunt focuses on initial access and script execution; persistence through session-policy changes is handled elsewhere.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple vulnerability alert does not indicate if exploitation has occurred; this hunt correlates the presence of the software with the behavioral signals of script drops and rare shell execution to distinguish unpatched systems from active compromises.", "coverage": [ { "stage": "initial-access-beyondtrust-bypass", "steps": [ "identify-affected-appliances", "unrecognized-script-creation" ], "status": "covered" }, { "stage": "execution-unauthorized-scripts", "steps": [ "rare-shell-execution", "unrecognized-script-creation" ], "status": "covered" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-privileged-sessions", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-log-tampering", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "BeyondTrust Remote Support Authentication Bypass", "slug": "initial-access-beyondtrust-bypass", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier", "CVE-2026-102764", "Unauthorized file operations on the B Series appliance" ] }, { "name": "Execution of Unrecognized Scripts", "slug": "execution-unauthorized-scripts", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Unrecognized script files on the appliance" ] }, { "name": "Account and MFA Manipulation", "slug": "persistence-account-manipulation", "tactic": "persistence", "techniques": [ "T1098", "T1556.006" ], "observables": [ "Unauthorized account changes", "Permission or session-policy modifications", "New MFA registrations on privileged accounts" ] }, { "name": "Unrecognized Privileged Sessions", "slug": "lateral-movement-privileged-sessions", "tactic": "lateral-movement", "techniques": [ "T1078", "T1021" ], "observables": [ "Unrecognized privileged or administrative sessions" ] }, { "name": "Detection Evasion via Log Tampering", "slug": "defense-evasion-log-tampering", "tactic": "defense-evasion", "techniques": [ "T1562.002" ], "observables": [ "Unexpected gaps in logs", "Unexpected gaps in log forwarding" ] } ], "summary": "Threat actors are exploiting a critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) to gain initial access and perform unauthorized file operations on vulnerable appliances. Post-exploitation, attackers execute unauthorized scripts, establish persistence through account and MFA manipulation, and move laterally using unrecognized privileged sessions while tampering with log forwarding to evade detection." }, "severity": "critical", "rationale": "Focus on self-hosted BeyondTrust/Bomgar appliances. Use software inventory to find these devices regardless of whether they have an active vulnerability finding, as the bypass is widely exploited.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited CVE-2026-102764 to bypass authentication on a BeyondTrust Remote Support appliance, resulting in unauthorized file operations and the execution of unrecognized scripts.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "List of hostnames of suspected appliances to narrow the search; leave empty to hunt across the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine for behavioral activity." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support", "name": "CISA \u2014 CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support" } ], "blind_spots": [ { "id": "no-appliance-telemetry", "risk": "A closed appliance without an agent will not report the behavioral activity this hunt relies on, leading to a false negative.", "stage": "execution-unauthorized-scripts", "question": "Whether the appliance was compromised but did not report file or process activity", "requires": "Endpoint telemetry on the appliance OS" }, { "id": "no-http-logs", "risk": "Without HTTP-level logs, the initial bypass is only visible via its behavioral aftermath (files and processes).", "stage": "initial-access-beyondtrust-bypass", "question": "The specific exploit path used for the authentication bypass", "requires": "hb_http_activity or appliance web logs" } ] }, "name": "BeyondTrust Appliance Compromise and Execution", "description": "This hunt targets the exploitation of BeyondTrust Remote Support (formerly Bomgar) appliances. It first identifies affected appliances in the estate, then fans out to search for the outcomes of the authentication bypass: the creation of unrecognized script files and the execution of rare shells or interpreters. By combining inventory scoping with behavioral activity, the hunt identifies compromised appliances even when network-level exploitation logs are missing." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support", "index": 1, "title": "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support", "total": 2 }, "coverage": [ { "stage": "initial-access-beyondtrust-bypass", "steps": [ "identify-affected-appliances", "unrecognized-script-creation" ], "status": "covered" }, { "stage": "execution-unauthorized-scripts", "steps": [ "rare-shell-execution", "unrecognized-script-creation" ], "status": "covered" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-privileged-sessions", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-log-tampering", "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.", "status": "out_of_scope" } ], "rationale": "An adversary has exploited CVE-2026-102764 to bypass authentication on a BeyondTrust Remote Support appliance, resulting in unauthorized file operations and the execution of unrecognized scripts.", "blind_spots": [ { "id": "no-appliance-telemetry", "risk": "A closed appliance without an agent will not report the behavioral activity this hunt relies on, leading to a false negative.", "stage": "execution-unauthorized-scripts", "question": "Whether the appliance was compromised but did not report file or process activity", "requires": "Endpoint telemetry on the appliance OS" }, { "id": "no-http-logs", "risk": "Without HTTP-level logs, the initial bypass is only visible via its behavioral aftermath (files and processes).", "stage": "initial-access-beyondtrust-bypass", "question": "The specific exploit path used for the authentication bypass", "requires": "hb_http_activity or appliance web logs" } ], "scoping_notes": "Focus on self-hosted BeyondTrust/Bomgar appliances. Use software inventory to find these devices regardless of whether they have an active vulnerability finding, as the bypass is widely exploited.", "beyond_detection": "A simple vulnerability alert does not indicate if exploitation has occurred; this hunt correlates the presence of the software with the behavioral signals of script drops and rare shell execution to distinguish unpatched systems from active compromises." } }, { "id": "identify-affected-appliances", "type": "query", "label": "Identify BeyondTrust Remote Support appliances", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%'", "surface": "hb_software_inventory", "description": "Use software inventory to find these devices regardless of whether they have an active vulnerability finding, to define the search scope.", "expected_signal": "Silence means no matching software packages are found in the inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify BeyondTrust Remote Support appliances", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%'", "silence": "not_evidence_of_absence", "expected": "Silence means no matching software packages are found in the inventory.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "rare-shell-execution", "type": "query", "label": "Rare shell and interpreter execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS shell_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (on_disk = 0 OR (LOWER(process_path) LIKE '%/sh' OR LOWER(process_path) LIKE '%/bash' OR LOWER(process_path) LIKE '%/python%' OR LOWER(process_path) LIKE '%/perl' OR LOWER(process_path) LIKE '%/php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY shell_path HAVING host_count <= 3 ORDER BY host_count ASC, run_count ASC", "surface": "hb_process_activity", "description": "The query stack-counts the execution of shells and interpreters on appliances so that one-host sessions stand out from fleet-wide activity.", "expected_signal": "A shell or interpreter path seen on very few hosts. Silence suggests no unusual shell sessions occurred during the window." }, "parents": [ { "id": "identify-affected-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare shell and interpreter execution", "reads": [ "process_path", "device_hostname", "time", "on_disk" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS shell_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (on_disk = 0 OR (LOWER(process_path) LIKE '%/sh' OR LOWER(process_path) LIKE '%/bash' OR LOWER(process_path) LIKE '%/python%' OR LOWER(process_path) LIKE '%/perl' OR LOWER(process_path) LIKE '%/php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY shell_path HAVING host_count <= 3 ORDER BY host_count ASC, run_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A shell or interpreter path seen on very few hosts. Silence suggests no unusual shell sessions occurred during the window.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-10-17" } }, { "id": "unrecognized-script-creation", "type": "query", "label": "Unrecognized script file creation", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%.py' OR LOWER(file_path) LIKE '%.pl' OR LOWER(file_path) LIKE '%.php') AND (LOWER(file_path) LIKE '/tmp/%' OR LOWER(file_path) LIKE '/var/tmp/%' OR LOWER(file_path) LIKE '/dev/shm/%' OR LOWER(file_path) LIKE '%/www/%' OR LOWER(file_path) LIKE '%/html/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find scripts dropped during exploitation.", "expected_signal": "Silence means no script creation was recorded." }, "parents": [ { "id": "identify-affected-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Unrecognized script file creation", "reads": [ "device_hostname", "file_path", "process_name", "actor_user_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%.py' OR LOWER(file_path) LIKE '%.pl' OR LOWER(file_path) LIKE '%.php') AND (LOWER(file_path) LIKE '/tmp/%' OR LOWER(file_path) LIKE '/var/tmp/%' OR LOWER(file_path) LIKE '/dev/shm/%' OR LOWER(file_path) LIKE '%/www/%' OR LOWER(file_path) LIKE '%/html/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Silence means no script creation was recorded.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "triage-exploitation", "type": "analytic", "label": "Triage exploitation evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "identify-affected-appliances", "rare-shell-execution", "unrecognized-script-creation" ], "objective": "Determine if any BeyondTrust appliance shows signs of active exploitation based on script drops and rare shell execution.", "description": "Evaluate the combined evidence of vulnerable software presence, rare shells, and new scripts to identify compromise.", "max_iterations": 4, "expected_signal": "A per-host verdict on whether the appliance has been exploited.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing specific scripts or process rows." }, "parents": [ { "id": "rare-shell-execution", "kind": "merge" }, { "id": "unrecognized-script-creation", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "no-appliance-telemetry", "confidence": "high", "description": "Route the hunt based on the agent's triage results.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-exploitation" } ] }, { "id": "isolate-appliance", "type": "action", "label": "Isolate appliance", "config": { "target": "endpoint", "description": "Contain the threat by isolating the compromised appliance.", "instructions": "Isolate the identified appliance host. Revoke all active support sessions and rotate credentials.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-forensic-review", "type": "task", "label": "Manual forensic review", "config": { "assignee": "analyst", "description": "Review evidence to confirm compromise or identify the extent of activity.", "instructions": "Review appliance syslog and web logs if available. Examine the dropped scripts and their contents to understand the attacker's intent." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-appliance" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Record findings and findings for the hunt.", "instructions": "Document the hosts examined, the presence of vulnerable software, and any suspicious file or process activity found." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-forensic-review" } ] } ] }