BeyondTrust Remote Support Pre-Auth Remote Code Execution

// CVE-2026-1731 — BeyondTrust Remote Support Pre-Auth RCE
// Detect exploitation attempts against BeyondTrust RS/PRA web interface
// via web server access logs, IDS alerts, and endpoint telemetry
let BeyondTrustPorts = dynamic([80, 443, 8080, 8443]);
let RCEIndicatorPaths = dynamic([
    "/beyondtrust", "/support", "/remote", "/api/",
    "/login", "/session", "/websocket"
]);
let SuspiciousUserAgents = dynamic([
    "python-requests", "curl", "wget", "Go-http-client",
    "Nuclei", "zgrab", "masscan"
]);
union CommonSecurityLog, W3CIISLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (BeyondTrustPorts)
    and (DeviceVendor has_any ("BeyondTrust", "Bomgar")
         or RequestURL has_any ("/beyondtrust", "/remote", "/login")
         or csUriStem has_any ("/beyondtrust", "/remote", "/login"))
| extend UserAgent = coalesce(RequestClientApplication, csUserAgent)
| where UserAgent has_any (SuspiciousUserAgents)
    or Message has_any ("command injection", "os.system", "exec", "shell", "/bin/sh", "cmd.exe")
    or (RequestMethod in ("POST", "PUT") and RequestURL has_any (RCEIndicatorPaths))
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort,
    RequestURL, RequestMethod, UserAgent, Message, AdditionalExtensions
| extend ThreatIndicator = "CVE-2026-1731-BeyondTrust-PreAuthRCE"
| sort by TimeGenerated desc

index=network sourcetype IN ("access_combined", "iis", "pan:traffic", "cisco:asa", "fortigate:traffic", "suricata", "snort")
(
  (dest_port IN (80, 443, 8080, 8443))
  AND (
    (uri_path IN ("/beyondtrust", "/remote", "/login", "/api") OR product="BeyondTrust" OR product="Bomgar")
    OR (cs_useragent IN ("python-requests", "curl", "wget", "Go-http-client", "Nuclei", "zgrab"))
    OR (method="POST" AND (uri_path="/login" OR uri_path="/api/"))
  )
)
| eval is_scanner=if(
    match(cs_useragent, "(?i)(nuclei|zgrab|masscan|python-requests|curl|wget|go-http-client)"),
    "true", "false"
  )
| eval is_post_to_api=if(
    method="POST" AND match(uri_path, "(?i)(/api/|/login|/session)"),
    "true", "false"
  )
| where is_scanner="true" OR is_post_to_api="true"
| stats count AS Requests,
        dc(src_ip) AS UniqueSourceIPs,
        values(src_ip) AS SourceIPs,
        values(cs_useragent) AS UserAgents,
        values(uri_path) AS Paths,
        values(method) AS Methods,
        values(status) AS StatusCodes
  BY dest_ip, dest_port, _time span=1h
| where Requests > 5
| eval CVE="CVE-2026-1731"
| eval Severity="CRITICAL"
| eval KEV_Listed="Yes"
| table _time, dest_ip, SourceIPs, UserAgents, Paths, Methods, StatusCodes, Requests, CVE, Severity, KEV_Listed
| sort - Requests