BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731)

let BeyondTrustPorts = dynamic([443, 80, 8080, 8443]);
let SuspiciousChildProcs = dynamic(["cmd.exe", "powershell.exe", "sh", "bash", "python", "python3", "wget", "curl", "nc", "ncat", "whoami", "id"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where InitiatingProcessParentFileName has_any ("bomgar", "beyondtrust", "remote_support", "pra", "rs_app")
    | where FileName in~ (SuspiciousChildProcs)
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
    | extend DetectionSource = "ProcessSpawn"
),
(
    DeviceNetworkEvents
    | where InitiatingProcessFileName has_any ("bomgar", "beyondtrust", "remote_support", "pra")
    | where RemotePort !in (BeyondTrustPorts)
    | where ActionType == "ConnectionSuccess"
    | where RemoteIPType != "Private"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
    | extend DetectionSource = "OutboundC2"
),
(
    CommonSecurityLog
    | where DeviceVendor == "BeyondTrust" or DeviceProduct has_any ("Remote Support", "Privileged Remote Access")
    | where Activity has_any ("command", "exec", "shell", "os", "injection")
    | project TimeGenerated, DeviceName, SourceIP, DestinationIP, Activity, AdditionalExtensions
    | extend DetectionSource = "ApplianceLog"
),
(
    W3CIISLog
    | where csUriStem has_any ("/api/", "/login", "/appliance", "/cgi-bin")
    | where csMethod == "POST"
    | where scStatus in (200, 500, 503)
    | where csUserAgent has_any ("python-requests", "curl", "Go-http-client", "exploit", "PoC")
    | project TimeGenerated, sSiteName, csUriStem, csMethod, scStatus, csUserAgent, cIP
    | extend DetectionSource = "WebLog"
)
| order by TimeGenerated desc

index=* sourcetype IN ("beyondtrust:syslog", "beyondtrust:rs", "beyondtrust:pra", "wineventlog", "syslog", "iis")
| eval is_bt_process=if(match(lower(process_name), "bomgar|beyondtrust|remote_support|rs_app|pra"), 1, 0)
| eval suspicious_child=if(match(lower(child_process_name), "cmd\.exe|powershell|bash|sh|python|wget|curl|nc|ncat|whoami|id"), 1, 0)
| eval suspicious_ua=if(match(lower(http_user_agent), "python-requests|curl/|go-http-client|exploit|poc|nuclei"), 1, 0)
| eval exploit_uri=if(match(lower(uri_path), "/api/|/login|/appliance|/cgi-bin"), 1, 0)
| eval outbound_anomaly=if(is_bt_process=1 AND dest_port NOT IN (80, 443, 8080, 8443) AND dest_category!="internal", 1, 0)
| where (is_bt_process=1 AND suspicious_child=1)
    OR (suspicious_ua=1 AND exploit_uri=1 AND http_method="POST" AND (status=200 OR status=500))
    OR (outbound_anomaly=1)
    OR (sourcetype="beyondtrust:syslog" AND match(lower(_raw), "exec|command|shell|injection|os\.system"))
| eval detection_reason=case(
    is_bt_process=1 AND suspicious_child=1, "BeyondTrust spawned suspicious child process",
    suspicious_ua=1 AND exploit_uri=1, "Exploit-like UA targeting appliance endpoint",
    outbound_anomaly=1, "BeyondTrust process made anomalous outbound connection",
    true(), "Appliance log command injection indicator"
  )
| table _time, host, src_ip, dest_ip, dest_port, process_name, child_process_name, uri_path, http_user_agent, status, detection_reason
| sort -_time

sequence by host.name with maxspan=5m
  [process where process.parent.name : ("bomgar*", "beyondtrust*", "remote_support*", "rs_app*", "pra*")
   and process.name : ("cmd.exe", "powershell.exe", "sh", "bash", "python*", "wget", "curl", "nc", "ncat", "whoami", "id")]
  [any where
    (event.category == "network" and destination.port not in (80, 443, 8080, 8443) and destination.ip != null)
    or
    (event.category == "file" and file.path : ("/tmp/*", "C:\\Windows\\Temp\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\*"))
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
    sourceip,
    destinationip,
    destinationport,
    username,
    "processname",
    "parentprocessname",
    QIDNAME(qid) AS event_name,
    category,
    logsourcename(logsourceid) AS log_source,
    UTF8(payload) AS raw_payload
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('BeyondTrust Remote Support', 'BeyondTrust PRA', 'Microsoft Windows Security Event Log', 'Apache Access Log', 'IIS')
    AND (
        (
            LOWER("parentprocessname") MATCHES '.*bomgar.*|.*beyondtrust.*|.*remote_support.*|.*rs_app.*|.*pra.*'
            AND LOWER("processname") IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'python', 'python3', 'wget', 'curl', 'nc', 'whoami', 'id')
        )
        OR (
            LOWER(UTF8(payload)) MATCHES '.*(exec|os\.system|shell_exec|command injection|;id;|;whoami;|\$\(id\)).*'
            AND LOGSOURCETYPENAME(devicetype) IN ('BeyondTrust Remote Support', 'BeyondTrust PRA')
        )
        OR (
            LOWER(UTF8(payload)) MATCHES '.*(python-requests|curl/|go-http-client|exploit|poc/cve-2026-1731).*'
            AND category = 'Web'
        )
    )
LAST 24 HOURS

_sourceCategory=beyondtrust* OR _sourceCategory=windows/security OR _sourceCategory=iis/access OR _sourceCategory=network/firewall
| parse regex field=_raw "(?<parent_proc>bomgar[^\s]*|beyondtrust[^\s]*|remote_support[^\s]*|rs_app[^\s]*)" nodrop
| parse regex field=_raw "(?<child_proc>cmd\.exe|powershell\.exe|/bin/sh|/bin/bash|python3?|wget|curl|ncat?|whoami|\bid\b)" nodrop
| parse regex field=_raw "(?<http_ua>python-requests[^\s]*|curl/[^\s]*|Go-http-client[^\s]*|exploit[^\s]*|CVE-2026-1731[^\s]*)" nodrop
| parse regex field=_raw "(?<inject_cmd>;id;|;whoami;|\$\(id\)|\$\(whoami\)|os\.system|shell_exec|exec\()" nodrop
| where (
    (parent_proc != "" and child_proc != "")
    or (http_ua != "")
    or (inject_cmd != "")
  )
| eval detection_type = if(parent_proc != "" and child_proc != "", "SuspiciousChildProcess",
    if(http_ua != "", "ExploitUserAgent", "CommandInjectionPayload"))
| count by _sourceHost, detection_type, parent_proc, child_proc, http_ua, inject_cmd
| sort by _count desc

rule cve_2026_1731_beyondtrust_preauth_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
    cve = "CVE-2026-1731"

  events:
    (
      // Child process spawned by BeyondTrust parent
      $e1.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e1.principal.process.parent_process.file.full_path, `(?i)(bomgar|beyondtrust|remote_support|rs_app|pra)`) and
      re.regex($e1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|/bin/sh|/bin/bash|python3?|wget|curl|ncat?|whoami|\bid\b)`)
    ) or
    (
      // Exploit-characteristic HTTP request to appliance
      $e1.metadata.event_type = "NETWORK_HTTP" and
      re.regex($e1.network.http.user_agent, `(?i)(python-requests|curl/|Go-http-client|CVE-2026-1731|exploit)`) and
      re.regex($e1.target.url, `(?i)(/api/|/login|/appliance|/cgi-bin)`) and
      $e1.network.http.method = "POST"
    ) or
    (
      // Command injection payload in BeyondTrust application log
      $e1.metadata.product_name = /(?i)beyondtrust|remote.support|privileged.remote.access/ and
      re.regex($e1.metadata.description, `(?i)(;id;|;whoami;|os\.system|shell_exec|exec\(|\$\(id\)|\$\(whoami\))`)
    )

  condition:
    $e1
}

// CVE-2026-1731 BeyondTrust Pre-Auth RCE Detection
#repo=base_activities
| filter event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6", "SyntheticProcessRollup2")
// Signal 1: Suspicious child process under BeyondTrust parent
| case {
    event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2"):
      filter match(tolower(ParentBaseFileName), "bomgar*") OR
             match(tolower(ParentBaseFileName), "beyondtrust*") OR
             match(tolower(ParentBaseFileName), "remote_support*") OR
             match(tolower(ParentBaseFileName), "rs_app*")
      | filter match(tolower(FileName), "cmd.exe") OR
               match(tolower(FileName), "powershell.exe") OR
               match(tolower(FileName), "bash") OR
               match(tolower(FileName), "sh") OR
               match(tolower(FileName), "python*") OR
               match(tolower(FileName), "wget") OR
               match(tolower(FileName), "curl") OR
               match(tolower(FileName), "nc") OR
               match(tolower(FileName), "whoami")
      | eval detection_type="SuspiciousChildProcess";
    event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6"):
      filter match(tolower(ImageFileName), "bomgar*") OR
             match(tolower(ImageFileName), "beyondtrust*") OR
             match(tolower(ImageFileName), "remote_support*")
      | filter NOT (RemotePort IN (80, 443, 8080, 8443))
      | filter NOT match(RemoteIP, "^10\\.|^192\\.168\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.")
      | eval detection_type="AnomalousOutboundConnection";
}
| select timestamp, aid, ComputerName, detection_type, ParentBaseFileName, FileName, CommandLine, RemoteIP, RemotePort
| sort timestamp desc