{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Compromise of a Remote Support appliance grants high-privileged access to the rest of the estate. A negative result over the estate confirms that active exploitation of CVE-2026-102764 has not yet transitioned to persistent identity manipulation on the appliances."
      },
      "name": "BeyondTrust Appliance Identity Persistence and Evasion",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1098",
        "attack.t1556.006",
        "attack.t1078",
        "attack.t1021",
        "attack.t1562.002",
        "attack.t1190",
        "defense evasion",
        "execution",
        "initial access",
        "lateral movement",
        "persistence"
      ],
      "series": {
        "slug": "cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support",
        "index": 2,
        "title": "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support",
        "total": 2
      },
      "related": [
        {
          "hunt": "beyondtrust-remote-support-initial-access",
          "reason": "Initial access via the authentication bypass itself is a separate hunt focused on web-server logs and exploit patterns.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "beyondtrust-appliance-compromise-execution",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single rule might detect a service stop or a new account, but this hunt correlates account manipulation, unusual authentication origins, and telemetry disruptions into a single narrative of appliance compromise.",
      "coverage": [
        {
          "stage": "persistence-account-manipulation",
          "steps": [
            "account-mfa-manipulation"
          ],
          "status": "covered"
        },
        {
          "stage": "lateral-movement-privileged-sessions",
          "steps": [
            "unusual-privileged-sessions"
          ],
          "status": "covered"
        },
        {
          "stage": "defense-evasion-log-tampering",
          "steps": [
            "log-tampering-indicators"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-beyondtrust-bypass",
          "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-unauthorized-scripts",
          "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "BeyondTrust Remote Support Authentication Bypass",
            "slug": "initial-access-beyondtrust-bypass",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier",
              "CVE-2026-102764",
              "Unauthorized file operations on the B Series appliance"
            ]
          },
          {
            "name": "Execution of Unrecognized Scripts",
            "slug": "execution-unauthorized-scripts",
            "tactic": "execution",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "Unrecognized script files on the appliance"
            ]
          },
          {
            "name": "Account and MFA Manipulation",
            "slug": "persistence-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098",
              "T1556.006"
            ],
            "observables": [
              "Unauthorized account changes",
              "Permission or session-policy modifications",
              "New MFA registrations on privileged accounts"
            ]
          },
          {
            "name": "Unrecognized Privileged Sessions",
            "slug": "lateral-movement-privileged-sessions",
            "tactic": "lateral-movement",
            "techniques": [
              "T1078",
              "T1021"
            ],
            "observables": [
              "Unrecognized privileged or administrative sessions"
            ]
          },
          {
            "name": "Detection Evasion via Log Tampering",
            "slug": "defense-evasion-log-tampering",
            "tactic": "defense-evasion",
            "techniques": [
              "T1562.002"
            ],
            "observables": [
              "Unexpected gaps in logs",
              "Unexpected gaps in log forwarding"
            ]
          }
        ],
        "summary": "Threat actors are exploiting a critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) to gain initial access and perform unauthorized file operations on vulnerable appliances. Post-exploitation, attackers execute unauthorized scripts, establish persistence through account and MFA manipulation, and move laterally using unrecognized privileged sessions while tampering with log forwarding to evade detection."
      },
      "severity": "high",
      "rationale": "The hunt should prioritize self-hosted appliances reachable from the internet. Focus on the lookback period starting from the public disclosure of CVE-2026-102764.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker who has exploited CVE-2026-102764 is establishing persistence by creating administrative accounts or modifying MFA factors while disabling logging services to hide their presence.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames of BeyondTrust appliances to focus the search; leave empty to scan the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Number of days of history to examine for post-exploitation activity."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support",
          "name": "CISA Alert: CVE-2026-102764 Critical Vulnerability in BeyondTrust Remote Support"
        }
      ],
      "blind_spots": [
        {
          "id": "telemetry-gaps-on-appliance",
          "risk": "An attacker who clears local logs before they ship will leave no trace, making behavioral queries return zero results while the threat persists.",
          "stage": "defense-evasion-log-tampering",
          "question": "Were logs deleted or forwarding stopped during the attack?",
          "requires": "appliance-side syslog forwarding stability"
        },
        {
          "id": "unrecorded-mfa-registrations",
          "risk": "If the appliance does not log the specific registration of a new MFA factor as an account change event, this hunt will not see the persistence mechanism.",
          "stage": "persistence-account-manipulation",
          "question": "Was a new MFA device registered by the attacker?",
          "requires": "hb_users with registration event history"
        }
      ]
    },
    "name": "BeyondTrust Appliance Identity Persistence and Evasion",
    "description": "This hunt targets post-exploitation activity on BeyondTrust (formerly Bomgar) appliances following initial access via CVE-2026-102764. It examines indicators of identity manipulation, such as new account creation and MFA changes, alongside evidence of defense evasion through the tampering of telemetry services. The hunt further investigates privileged sign-in sessions that may represent lateral movement or unauthorized access. By correlating account changes, authentication patterns, and service state changes, the hunt provides a comprehensive look at the appliance's integrity."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support",
          "index": 2,
          "title": "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support",
          "total": 2
        },
        "coverage": [
          {
            "stage": "persistence-account-manipulation",
            "steps": [
              "account-mfa-manipulation"
            ],
            "status": "covered"
          },
          {
            "stage": "lateral-movement-privileged-sessions",
            "steps": [
              "unusual-privileged-sessions"
            ],
            "status": "covered"
          },
          {
            "stage": "defense-evasion-log-tampering",
            "steps": [
              "log-tampering-indicators"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-beyondtrust-bypass",
            "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-unauthorized-scripts",
            "reason": "Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker who has exploited CVE-2026-102764 is establishing persistence by creating administrative accounts or modifying MFA factors while disabling logging services to hide their presence.",
        "blind_spots": [
          {
            "id": "telemetry-gaps-on-appliance",
            "risk": "An attacker who clears local logs before they ship will leave no trace, making behavioral queries return zero results while the threat persists.",
            "stage": "defense-evasion-log-tampering",
            "question": "Were logs deleted or forwarding stopped during the attack?",
            "requires": "appliance-side syslog forwarding stability"
          },
          {
            "id": "unrecorded-mfa-registrations",
            "risk": "If the appliance does not log the specific registration of a new MFA factor as an account change event, this hunt will not see the persistence mechanism.",
            "stage": "persistence-account-manipulation",
            "question": "Was a new MFA device registered by the attacker?",
            "requires": "hb_users with registration event history"
          }
        ],
        "scoping_notes": "The hunt should prioritize self-hosted appliances reachable from the internet. Focus on the lookback period starting from the public disclosure of CVE-2026-102764.",
        "beyond_detection": "A single rule might detect a service stop or a new account, but this hunt correlates account manipulation, unusual authentication origins, and telemetry disruptions into a single narrative of appliance compromise."
      }
    },
    {
      "id": "find-beyondtrust-appliances",
      "type": "query",
      "label": "Identify BeyondTrust Appliances",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%') AND LOWER(package_name) LIKE '%remote support%'",
        "surface": "hb_software_inventory",
        "description": "The hunt locates all self-hosted BeyondTrust/Bomgar Remote Support appliances within the software inventory to define the scoping for subsequent queries.",
        "expected_signal": "If empty, no self-hosted appliances were found in the current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify BeyondTrust Appliances",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%') AND LOWER(package_name) LIKE '%remote support%'",
        "silence": "not_evidence_of_absence",
        "expected": "If empty, no self-hosted appliances were found in the current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-17"
      }
    },
    {
      "id": "account-mfa-manipulation",
      "type": "query",
      "label": "Account and MFA Manipulation",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 4) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_account_change",
        "description": "The query identifies unauthorized account creation or password resets on the appliances, which indicates an attacker establishing persistence.",
        "expected_signal": "A row representing an account created or a password changed. Unexpected actor accounts like SYSTEM are high-fidelity indicators."
      },
      "parents": [
        {
          "id": "find-beyondtrust-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Account and MFA Manipulation",
        "reads": [
          "activity_id",
          "activity_name",
          "actor_user_name",
          "device_hostname",
          "time",
          "user_name"
        ],
        "source": "hb_account_change",
        "target": "endpoint",
        "content": "SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 4) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A row representing an account created or a password changed. Unexpected actor accounts like SYSTEM are high-fidelity indicators.",
        "verified": "dry-run",
        "verified_at": "2026-10-17"
      }
    },
    {
      "id": "unusual-privileged-sessions",
      "type": "query",
      "label": "Unusual Privileged Sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, logon_type, COUNT(*) AS login_count FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip, logon_type HAVING login_count <= 5",
        "surface": "hb_auth_signin",
        "description": "The query examines sign-in activity for rare users or source IPs on the appliances to detect lateral movement or unauthorized admin access.",
        "expected_signal": "Frequent legitimate logins are filtered by the stack count."
      },
      "parents": [
        {
          "id": "find-beyondtrust-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Unusual Privileged Sign-ins",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "logon_type",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, logon_type, COUNT(*) AS login_count FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip, logon_type HAVING login_count <= 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "Frequent legitimate logins are filtered by the stack count.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "actor_user_name",
            "src_endpoint_ip"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-17"
      }
    },
    {
      "id": "log-tampering-indicators",
      "type": "query",
      "label": "Telemetry Service Disruptions",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE '%log%' OR LOWER(service_name) LIKE '%syslog%' OR LOWER(service_name) LIKE '%event%') AND service_state IN ('Stopped', 'Disabled') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_service_activity",
        "description": "The query detects deliberate stopping or disabling of logging and auditing services on the appliance, a common defense evasion technique.",
        "expected_signal": "Service state changes for logging processes on the appliance suggest intentional tampering."
      },
      "parents": [
        {
          "id": "find-beyondtrust-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Telemetry Service Disruptions",
        "reads": [
          "device_hostname",
          "service_name",
          "service_state",
          "time"
        ],
        "source": "hb_service_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE '%log%' OR LOWER(service_name) LIKE '%syslog%' OR LOWER(service_name) LIKE '%event%') AND service_state IN ('Stopped', 'Disabled') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Service state changes for logging processes on the appliance suggest intentional tampering.",
        "verified": "dry-run",
        "verified_at": "2026-10-17"
      }
    },
    {
      "id": "triage-appliance-evidence",
      "type": "analytic",
      "label": "Correlate Appliance Evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "find-beyondtrust-appliances",
          "account-mfa-manipulation",
          "unusual-privileged-sessions",
          "log-tampering-indicators"
        ],
        "objective": "The agent reviews the findings from account changes, sign-ins, and service states to determine if a specific appliance has been compromised.",
        "description": "The agent reviews the findings from account changes, sign-ins, and service states to determine if a specific appliance has been compromised.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict citing whether identity changes were corroborated by unusual logins or logging gaps.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign with cited rows for each claim."
      },
      "parents": [
        {
          "id": "account-mfa-manipulation",
          "kind": "merge"
        },
        {
          "id": "unusual-privileged-sessions",
          "kind": "merge"
        },
        {
          "id": "log-tampering-indicators",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on Triage Result",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent verdict is malicious for at least one host identified as a BeyondTrust appliance",
        "condition": "the agent verdict is malicious for at least one host identified as a BeyondTrust appliance",
        "blind_spot": "telemetry-gaps-on-appliance",
        "confidence": "high",
        "description": "The decision routes the hunt based on the agent's verdict for the suspected appliances.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-appliance-evidence"
        }
      ]
    },
    {
      "id": "isolate-and-revoke",
      "type": "action",
      "label": "Isolate Host and Revoke Credentials",
      "config": {
        "target": "endpoint",
        "description": "The action prevents further lateral movement and persistence by isolating the compromised appliance and revoking all credentials.",
        "instructions": "Isolate the identified BeyondTrust appliance host immediately. Revoke all active support sessions and rotate any credentials stored on the appliance or injected during sessions.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst Forensics Review",
      "config": {
        "assignee": "analyst",
        "description": "A human analyst reviews the cited evidence to confirm the compromise and verify the effectiveness of containment.",
        "instructions": "Review the agent's triage report and cited logs. Conduct a forensic investigation for unrecognized script files and unauthorized MFA registrations. Verify if telemetry gaps align with the suspected exploitation window."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt Close-out",
      "config": {
        "assignee": "analyst",
        "description": "The hunt documents its findings and schedules any necessary remediation.",
        "instructions": "Document the findings of the hunt and schedule a follow-up if the vulnerability has not yet been patched. Ensure the appliances are scheduled for patching to version 26.2.4 or higher."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}