--- analysis: A single rule might detect a service stop or a new account, but this hunt correlates account manipulation, unusual authentication origins, and telemetry disruptions into a single narrative of appliance compromise. blind_spots: - id: telemetry-gaps-on-appliance question: Were logs deleted or forwarding stopped during the attack? requires: appliance-side syslog forwarding stability risk: An attacker who clears local logs before they ship will leave no trace, making behavioral queries return zero results while the threat persists. stage: defense-evasion-log-tampering - id: unrecorded-mfa-registrations question: Was a new MFA device registered by the attacker? requires: hb_users with registration event history risk: If the appliance does not log the specific registration of a new MFA factor as an account change event, this hunt will not see the persistence mechanism. stage: persistence-account-manipulation coverage: - stage: persistence-account-manipulation status: covered steps: - account-mfa-manipulation - stage: lateral-movement-privileged-sessions status: covered steps: - unusual-privileged-sessions - stage: defense-evasion-log-tampering status: covered steps: - log-tampering-indicators - reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series. stage: initial-access-beyondtrust-bypass status: out_of_scope - reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series. stage: execution-unauthorized-scripts status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Compromise of a Remote Support appliance grants high-privileged access to the rest of the estate. A negative result over the estate confirms that active exploitation of CVE-2026-102764 has not yet transitioned to persistent identity manipulation on the appliances. methodology: model-assisted trigger: intel-report hypothesis: An attacker who has exploited CVE-2026-102764 is establishing persistence by creating administrative accounts or modifying MFA factors while disabling logging services to hide their presence. labels: - hunt - attack.t1098 - attack.t1556.006 - attack.t1078 - attack.t1021 - attack.t1562.002 - attack.t1190 - defense evasion - execution - initial access - lateral movement - persistence name: BeyondTrust Appliance Identity Persistence and Evasion parameters: lookback_days: default: '14' description: Number of days of history to examine for post-exploitation activity. type: number scope_hosts: default: [] description: Specific hostnames of BeyondTrust appliances to focus the search; leave empty to scan the entire estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt should prioritize self-hosted appliances reachable from the internet. Focus on the lookback period starting from the public disclosure of CVE-2026-102764. references: - name: 'CISA Alert: CVE-2026-102764 Critical Vulnerability in BeyondTrust Remote Support' url: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support related: - hunt: beyondtrust-remote-support-initial-access reason: Initial access via the authentication bypass itself is a separate hunt focused on web-server logs and exploit patterns. relation: out-of-scope-alternative - hunt: beyondtrust-appliance-compromise-execution relation: follows scenario: stages: - name: BeyondTrust Remote Support Authentication Bypass observables: - BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier - CVE-2026-102764 - Unauthorized file operations on the B Series appliance slug: initial-access-beyondtrust-bypass tactic: initial-access techniques: - T1190 - name: Execution of Unrecognized Scripts observables: - Unrecognized script files on the appliance slug: execution-unauthorized-scripts tactic: execution techniques: - T1059 - name: Account and MFA Manipulation observables: - Unauthorized account changes - Permission or session-policy modifications - New MFA registrations on privileged accounts slug: persistence-account-manipulation tactic: persistence techniques: - T1098 - T1556.006 - name: Unrecognized Privileged Sessions observables: - Unrecognized privileged or administrative sessions slug: lateral-movement-privileged-sessions tactic: lateral-movement techniques: - T1078 - T1021 - name: Detection Evasion via Log Tampering observables: - Unexpected gaps in logs - Unexpected gaps in log forwarding slug: defense-evasion-log-tampering tactic: defense-evasion techniques: - T1562.002 summary: Threat actors are exploiting a critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) to gain initial access and perform unauthorized file operations on vulnerable appliances. Post-exploitation, attackers execute unauthorized scripts, establish persistence through account and MFA manipulation, and move laterally using unrecognized privileged sessions while tampering with log forwarding to evade detection. series: index: 2 slug: cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support title: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # BeyondTrust Appliance Identity Persistence and Evasion This hunt targets post-exploitation activity on BeyondTrust (formerly Bomgar) appliances following initial access via CVE-2026-102764. It examines indicators of identity manipulation, such as new account creation and MFA changes, alongside evidence of defense evasion through the tampering of telemetry services. The hunt further investigates privileged sign-in sessions that may represent lateral movement or unauthorized access. By correlating account changes, authentication patterns, and service state changes, the hunt provides a comprehensive look at the appliance's integrity. ## find-beyondtrust-appliances The hunt locates all self-hosted BeyondTrust/Bomgar Remote Support appliances within the software inventory to define the scoping for subsequent queries. ```sqlite target=endpoint role=scoping ~~~yaml expected: If empty, no self-hosted appliances were found in the current inventory. reads: - device_hostname - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-17' ~~~ SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%') AND LOWER(package_name) LIKE '%remote support%' ``` ## investigate-appliance-activity parallel: - → account-mfa-manipulation - → unusual-privileged-sessions - → log-tampering-indicators join: → triage-appliance-evidence ## account-mfa-manipulation The query identifies unauthorized account creation or password resets on the appliances, which indicates an attacker establishing persistence. ```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: A row representing an account created or a password changed. Unexpected actor accounts like SYSTEM are high-fidelity indicators. reads: - activity_id - activity_name - actor_user_name - device_hostname - time - user_name silence: not_evidence_of_absence source: hb_account_change verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 4) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## unusual-privileged-sessions The query examines sign-in activity for rare users or source IPs on the appliances to detect lateral movement or unauthorized admin access. ```sqlite target=identity role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: new_this_window window: '{{lookback_days}}d' expected: Frequent legitimate logins are filtered by the stack count. prevalence: by: device_hostname key: - actor_user_name - src_endpoint_ip rare_below: 5 reads: - actor_user_name - device_hostname - logon_type - src_endpoint_ip - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-17' ~~~ SELECT actor_user_name, device_hostname, src_endpoint_ip, logon_type, COUNT(*) AS login_count FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip, logon_type HAVING login_count <= 5 ``` ## log-tampering-indicators The query detects deliberate stopping or disabling of logging and auditing services on the appliance, a common defense evasion technique. ```sqlite target=endpoint role=enrichment params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Service state changes for logging processes on the appliance suggest intentional tampering. reads: - device_hostname - service_name - service_state - time silence: not_evidence_of_absence source: hb_service_activity verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE '%log%' OR LOWER(service_name) LIKE '%syslog%' OR LOWER(service_name) LIKE '%event%') AND service_state IN ('Stopped', 'Disabled') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-appliance-evidence ```agent target=hunter cite: required context: - find-beyondtrust-appliances - account-mfa-manipulation - unusual-privileged-sessions - log-tampering-indicators max_iterations: 5 objective: The agent reviews the findings from account changes, sign-ins, and service states to determine if a specific appliance has been compromised. success_criteria: A per-host verdict of malicious, suspicious, or benign with cited rows for each claim. tools: - endpoint - identity ``` ## route-on-verdict if~: "the agent verdict is malicious for at least one host identified as a BeyondTrust appliance" (confidence: high, judge=hunter) then: → isolate-and-revoke indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: telemetry-gaps-on-appliance) else: → close-out ## isolate-and-revoke ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified BeyondTrust appliance host immediately. Revoke all active support sessions and rotate any credentials stored on the appliance or injected during sessions. ``` → analyst-review ## analyst-review ```manual target=analyst Review the agent's triage report and cited logs. Conduct a forensic investigation for unrecognized script files and unauthorized MFA registrations. Verify if telemetry gaps align with the suspected exploitation window. ``` → end ## close-out ```manual target=analyst Document the findings of the hunt and schedule a follow-up if the vulnerability has not yet been patched. Ensure the appliances are scheduled for patching to version 26.2.4 or higher. ``` → end