BeyondTrust Appliance Identity Persistence and Evasion

Source

---
analysis: A single rule might detect a service stop or a new account, but this hunt
  correlates account manipulation, unusual authentication origins, and telemetry disruptions
  into a single narrative of appliance compromise.
blind_spots:
- id: telemetry-gaps-on-appliance
  question: Were logs deleted or forwarding stopped during the attack?
  requires: appliance-side syslog forwarding stability
  risk: An attacker who clears local logs before they ship will leave no trace, making
    behavioral queries return zero results while the threat persists.
  stage: defense-evasion-log-tampering
- id: unrecorded-mfa-registrations
  question: Was a new MFA device registered by the attacker?
  requires: hb_users with registration event history
  risk: If the appliance does not log the specific registration of a new MFA factor
    as an account change event, this hunt will not see the persistence mechanism.
  stage: persistence-account-manipulation
coverage:
- stage: persistence-account-manipulation
  status: covered
  steps:
  - account-mfa-manipulation
- stage: lateral-movement-privileged-sessions
  status: covered
  steps:
  - unusual-privileged-sessions
- stage: defense-evasion-log-tampering
  status: covered
  steps:
  - log-tampering-indicators
- reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability
    in BeyondTrust Remote Support' series.
  stage: initial-access-beyondtrust-bypass
  status: out_of_scope
- reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability
    in BeyondTrust Remote Support' series.
  stage: execution-unauthorized-scripts
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Compromise of a Remote Support appliance grants high-privileged access
    to the rest of the estate. A negative result over the estate confirms that active
    exploitation of CVE-2026-102764 has not yet transitioned to persistent identity
    manipulation on the appliances.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker who has exploited CVE-2026-102764 is establishing persistence
  by creating administrative accounts or modifying MFA factors while disabling logging
  services to hide their presence.
labels:
- hunt
- attack.t1098
- attack.t1556.006
- attack.t1078
- attack.t1021
- attack.t1562.002
- attack.t1190
- defense evasion
- execution
- initial access
- lateral movement
- persistence
name: BeyondTrust Appliance Identity Persistence and Evasion
parameters:
  lookback_days:
    default: '14'
    description: Number of days of history to examine for post-exploitation activity.
    type: number
  scope_hosts:
    default: []
    description: Specific hostnames of BeyondTrust appliances to focus the search;
      leave empty to scan the entire estate.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: The hunt should prioritize self-hosted appliances reachable from the internet.
  Focus on the lookback period starting from the public disclosure of CVE-2026-102764.
references:
- name: 'CISA Alert: CVE-2026-102764 Critical Vulnerability in BeyondTrust Remote
    Support'
  url: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
related:
- hunt: beyondtrust-remote-support-initial-access
  reason: Initial access via the authentication bypass itself is a separate hunt focused
    on web-server logs and exploit patterns.
  relation: out-of-scope-alternative
- hunt: beyondtrust-appliance-compromise-execution
  relation: follows
scenario:
  stages:
  - name: BeyondTrust Remote Support Authentication Bypass
    observables:
    - BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier
    - CVE-2026-102764
    - Unauthorized file operations on the B Series appliance
    slug: initial-access-beyondtrust-bypass
    tactic: initial-access
    techniques:
    - T1190
  - name: Execution of Unrecognized Scripts
    observables:
    - Unrecognized script files on the appliance
    slug: execution-unauthorized-scripts
    tactic: execution
    techniques:
    - T1059
  - name: Account and MFA Manipulation
    observables:
    - Unauthorized account changes
    - Permission or session-policy modifications
    - New MFA registrations on privileged accounts
    slug: persistence-account-manipulation
    tactic: persistence
    techniques:
    - T1098
    - T1556.006
  - name: Unrecognized Privileged Sessions
    observables:
    - Unrecognized privileged or administrative sessions
    slug: lateral-movement-privileged-sessions
    tactic: lateral-movement
    techniques:
    - T1078
    - T1021
  - name: Detection Evasion via Log Tampering
    observables:
    - Unexpected gaps in logs
    - Unexpected gaps in log forwarding
    slug: defense-evasion-log-tampering
    tactic: defense-evasion
    techniques:
    - T1562.002
  summary: Threat actors are exploiting a critical authentication bypass in BeyondTrust
    Remote Support (CVE-2026-102764) to gain initial access and perform unauthorized
    file operations on vulnerable appliances. Post-exploitation, attackers execute
    unauthorized scripts, establish persistence through account and MFA manipulation,
    and move laterally using unrecognized privileged sessions while tampering with
    log forwarding to evade detection.
series:
  index: 2
  slug: cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support
  title: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
tlp: clear
type: investigation
---


# BeyondTrust Appliance Identity Persistence and Evasion

This hunt targets post-exploitation activity on BeyondTrust (formerly Bomgar) appliances following initial access via CVE-2026-102764. It examines indicators of identity manipulation, such as new account creation and MFA changes, alongside evidence of defense evasion through the tampering of telemetry services. The hunt further investigates privileged sign-in sessions that may represent lateral movement or unauthorized access. By correlating account changes, authentication patterns, and service state changes, the hunt provides a comprehensive look at the appliance's integrity.

## find-beyondtrust-appliances
<!-- Identify BeyondTrust Appliances -->
The hunt locates all self-hosted BeyondTrust/Bomgar Remote Support appliances within the software inventory to define the scoping for subsequent queries.

```sqlite target=endpoint role=scoping
~~~yaml
expected: If empty, no self-hosted appliances were found in the current inventory.
reads:
- device_hostname
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-10-17'
~~~
SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%') AND LOWER(package_name) LIKE '%remote support%'
```

## investigate-appliance-activity
<!-- Investigate Identity and Evasion Indicators -->
parallel:
- → account-mfa-manipulation
- → unusual-privileged-sessions
- → log-tampering-indicators
join: → triage-appliance-evidence

## account-mfa-manipulation
<!-- Account and MFA Manipulation -->
The query identifies unauthorized account creation or password resets on the appliances, which indicates an attacker establishing persistence.

```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: A row representing an account created or a password changed. Unexpected
  actor accounts like SYSTEM are high-fidelity indicators.
reads:
- activity_id
- activity_name
- actor_user_name
- device_hostname
- time
- user_name
silence: not_evidence_of_absence
source: hb_account_change
verified: dry-run
verified_at: '2026-10-17'
~~~
SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 4) AND time >= datetime('now', '-{{lookback_days}} days')
```

## unusual-privileged-sessions
<!-- Unusual Privileged Sign-ins -->
The query examines sign-in activity for rare users or source IPs on the appliances to detect lateral movement or unauthorized admin access.

```sqlite target=identity role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: Frequent legitimate logins are filtered by the stack count.
prevalence:
  by: device_hostname
  key:
  - actor_user_name
  - src_endpoint_ip
  rare_below: 5
reads:
- actor_user_name
- device_hostname
- logon_type
- src_endpoint_ip
- status_id
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-10-17'
~~~
SELECT actor_user_name, device_hostname, src_endpoint_ip, logon_type, COUNT(*) AS login_count FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip, logon_type HAVING login_count <= 5
```

## log-tampering-indicators
<!-- Telemetry Service Disruptions -->
The query detects deliberate stopping or disabling of logging and auditing services on the appliance, a common defense evasion technique.

```sqlite target=endpoint role=enrichment params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Service state changes for logging processes on the appliance suggest intentional
  tampering.
reads:
- device_hostname
- service_name
- service_state
- time
silence: not_evidence_of_absence
source: hb_service_activity
verified: dry-run
verified_at: '2026-10-17'
~~~
SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE '%log%' OR LOWER(service_name) LIKE '%syslog%' OR LOWER(service_name) LIKE '%event%') AND service_state IN ('Stopped', 'Disabled') AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-appliance-evidence
<!-- Correlate Appliance Evidence -->
```agent target=hunter
cite: required
context:
- find-beyondtrust-appliances
- account-mfa-manipulation
- unusual-privileged-sessions
- log-tampering-indicators
max_iterations: 5
objective: The agent reviews the findings from account changes, sign-ins, and service
  states to determine if a specific appliance has been compromised.
success_criteria: A per-host verdict of malicious, suspicious, or benign with cited
  rows for each claim.
tools:
- endpoint
- identity
```

## route-on-verdict
<!-- Route on Triage Result -->
if~: "the agent verdict is malicious for at least one host identified as a BeyondTrust appliance" (confidence: high, judge=hunter)
then: → isolate-and-revoke
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: telemetry-gaps-on-appliance)
else: → close-out

## isolate-and-revoke
<!-- Isolate Host and Revoke Credentials -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the identified BeyondTrust appliance host immediately. Revoke all active support sessions and rotate any credentials stored on the appliance or injected during sessions.
```
→ analyst-review

## analyst-review
<!-- Analyst Forensics Review -->
```manual target=analyst
Review the agent's triage report and cited logs. Conduct a forensic investigation for unrecognized script files and unauthorized MFA registrations. Verify if telemetry gaps align with the suspected exploitation window.
```
→ end

## close-out
<!-- Hunt Close-out -->
```manual target=analyst
Document the findings of the hunt and schedule a follow-up if the vulnerability has not yet been patched. Ensure the appliances are scheduled for patching to version 26.2.4 or higher.
```
→ end