CVE-2026-102764 Elastic Security · Elastic

Detect BeyondTrust Remote Support Authentication Bypass by Spoofing (CVE-2026-102764) in Elastic Security

Detects exploitation of CVE-2026-102764, an authentication bypass by spoofing vulnerability (CWE-290) in BeyondTrust Remote Support. An unauthenticated remote attacker can spoof trusted identity/session attributes to bypass authentication and gain privileged access to the Remote Support appliance. Listed in CISA KEV and tied to China-linked threat-actor exploitation. Detection focuses on anomalous authentication successes, administrative session creation from untrusted sources, and spoofed session-origin indicators against BeyondTrust Remote Support appliances.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [ any where event.category == "authentication" and event.outcome == "success"
      and message : ("*admin*", "*support_session*", "*session.created*")
      and (message : ("*no_mfa*", "*origin_mismatch*", "*spoof*", "*x-forwarded-for*") or not message : "*mfa=*") ]
  [ any where event.category == "authentication" and event.outcome == "success" ]
critical severity medium confidence

Correlates consecutive BeyondTrust Remote Support authentication successes that bypass MFA or carry spoofing indicators, consistent with CVE-2026-102764.

Data Sources

Appliance authentication logsSyslog

Required Tables

logs-*filebeat-*

False Positives & Tuning

  • SSO flows where MFA is enforced at the identity provider and not logged on the appliance.
  • Automated health checks producing repeated successful auth events.
  • Proxy-fronted deployments adding forwarding headers.

Other platforms for CVE-2026-102764

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulate spoofed authentication success without MFA

    Expected signal: Syslog auth event containing 'authentication success', 'admin', 'session.created', and 'no_mfa' indicators.

  2. Test 2 Simulate origin-mismatch X-Forwarded-For spoof

    Expected signal: Auth log entry containing 'login granted', 'administrator', 'x-forwarded-for', and 'origin_mismatch'.

  3. Test 3 Simulate rapid repeated bypass sessions

    Expected signal: Three auth-success events from the same source within the correlation window.

Last updated: 2026-10-17 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the affected host is a BeyondTrust Remote Support appliance and identify its version against advisory BT26-05 to determine patch status.
  2. Review the flagged authentication-success events and determine whether a corresponding credential/MFA challenge and legitimate user session exist; absence indicates spoofed authentication.
  3. Extract and geolocate the source IP(s); check for known China-linked threat-actor infrastructure and whether the source is outside expected administrative ranges.
  4. Correlate the timestamp with any new admin/support sessions, configuration changes, or jump-client deployments on the appliance.

Containment

  1. Immediately restrict external access to the Remote Support appliance management and session interfaces via firewall/ACL to trusted IPs only.
  2. Disable or force-logout active suspicious sessions and rotate all appliance administrator credentials and API/session tokens.
  3. Apply the BeyondTrust fixed release per advisory BT26-05 (or take the appliance offline if a patch is not yet available).

Evidence Collection

  1. Export appliance authentication, session, and syslog records covering the suspected exploitation window, preserving original timestamps.
  2. Capture the appliance configuration, deployed jump-client/session inventory, and any outbound connections initiated post-compromise.

Escalation Criteria

  • !Escalate to incident response immediately if an admin/support session was created without a corresponding legitimate login, indicating successful authentication bypass.
  • !Escalate to threat intel and leadership if source infrastructure matches known nation-state actors or if lateral movement from the appliance is observed.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Appliance authentication and session logs showing success events without MFA/credential challenge.
  • >Newly created support/admin sessions and associated jump-client deployments.
  • >Reverse-proxy / web server access logs containing anomalous X-Forwarded-For or origin headers.

Tuning Guidance

Baseline the normal set of source IPs and service accounts that authenticate to the appliance and the way MFA/SSO events are logged in your environment. If MFA is enforced at an upstream IdP and not reflected in appliance logs, narrow the rule to origin-mismatch/spoof indicators and admin-session creation rather than the absence of 'mfa=' to reduce false positives. Allowlist known monitoring accounts and proxy IPs.

Hunting Queries

Hunts for support/admin session creation events lacking any MFA context on BeyondTrust Remote Support appliances.

Hunting — KQL
kql 
Syslog | where Computer has_any ("beyondtrust","remotesupport") | where SyslogMessage has "session.created" and SyslogMessage !has "mfa=" | project TimeGenerated, Computer, SyslogMessage
Hunting — SPL
spl 
index=beyondtrust "session.created" NOT "mfa=" | table _time host _raw

Atomic Red Team Tests

Test 1 Simulate spoofed authentication success without MFA
linux

Generates a syslog authentication-success event for an admin session lacking an MFA marker to validate detection logic in a lab.

Command

bash 
logger -p auth.info -t remote-support 'authentication success user=admin support_session session.created src=203.0.113.45 origin_mismatch no_mfa'

Cleanup

bash 
sudo sed -i '/support_session session.created/d' /var/log/auth.log 2>/dev/null || true

Expected Telemetry

Syslog auth event containing 'authentication success', 'admin', 'session.created', and 'no_mfa' indicators.

Expected Detection

KQL/SPL rules fire on admin authentication success lacking MFA with spoofing indicators.

Test 2 Simulate origin-mismatch X-Forwarded-For spoof
linux

Emits a web/auth log entry with a mismatched X-Forwarded-For header mimicking identity spoofing against the appliance.

Command

bash 
logger -p auth.notice -t remote-support 'login granted user=administrator x-forwarded-for=10.0.0.5 real_src=198.51.100.7 origin_mismatch support_session'

Cleanup

bash 
sudo sed -i '/origin_mismatch support_session/d' /var/log/auth.log 2>/dev/null || true

Expected Telemetry

Auth log entry containing 'login granted', 'administrator', 'x-forwarded-for', and 'origin_mismatch'.

Expected Detection

Detection rules flag spoofed-origin administrative login success.

Test 3 Simulate rapid repeated bypass sessions
linux

Writes multiple successive admin session-created events from one source to trigger the count/sequence thresholds.

Command

bash 
for i in 1 2 3; do logger -p auth.info -t remote-support "authentication success user=admin support_session session.created src=203.0.113.45 no_mfa attempt=$i"; done

Cleanup

bash 
sudo sed -i '/support_session session.created/d' /var/log/auth.log 2>/dev/null || true

Expected Telemetry

Three auth-success events from the same source within the correlation window.

Expected Detection

Count/sequence-based rules (KQL summarize >1, SPL where count>1, EQL sequence) fire on repeated bypass sessions.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0004 Privilege Escalation TA0006 Credential Access

Related Techniques

T1190 Exploit Public-Facing Application T1078 Valid Accounts T1557 Adversary-in-the-Middle

Same Tactic: Initial Access

Popular Detections