Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-1731.
Upgrade to ProDetect BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731) in Microsoft Sentinel
Detects exploitation of CVE-2026-1731, a pre-authentication remote code execution vulnerability (CWE-78, OS command injection) in BeyondTrust Remote Support and Privileged Remote Access. CVSS 9.8. Actively exploited in the wild (CISA KEV). Attackers can execute arbitrary OS commands without authentication via crafted HTTP requests to the appliance web interface.
MITRE ATT&CK
KQL Detection Query
let BeyondTrustPorts = dynamic([443, 80, 8080, 8443]);
let SuspiciousChildProcs = dynamic(["cmd.exe", "powershell.exe", "sh", "bash", "python", "python3", "wget", "curl", "nc", "ncat", "whoami", "id"]);
union isfuzzy=true
(
DeviceProcessEvents
| where InitiatingProcessParentFileName has_any ("bomgar", "beyondtrust", "remote_support", "pra", "rs_app")
| where FileName in~ (SuspiciousChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend DetectionSource = "ProcessSpawn"
),
(
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("bomgar", "beyondtrust", "remote_support", "pra")
| where RemotePort !in (BeyondTrustPorts)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType != "Private"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| extend DetectionSource = "OutboundC2"
),
(
CommonSecurityLog
| where DeviceVendor == "BeyondTrust" or DeviceProduct has_any ("Remote Support", "Privileged Remote Access")
| where Activity has_any ("command", "exec", "shell", "os", "injection")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, Activity, AdditionalExtensions
| extend DetectionSource = "ApplianceLog"
),
(
W3CIISLog
| where csUriStem has_any ("/api/", "/login", "/appliance", "/cgi-bin")
| where csMethod == "POST"
| where scStatus in (200, 500, 503)
| where csUserAgent has_any ("python-requests", "curl", "Go-http-client", "exploit", "PoC")
| project TimeGenerated, sSiteName, csUriStem, csMethod, scStatus, csUserAgent, cIP
| extend DetectionSource = "WebLog"
)
| order by TimeGenerated descDetects CVE-2026-1731 exploitation via suspicious child processes spawned by BeyondTrust appliance services, anomalous outbound connections from BeyondTrust processes, appliance log command injection indicators, and exploit-like HTTP user-agent strings targeting appliance endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate BeyondTrust administrative scripts that spawn shell processes during maintenance
- Authorized penetration testing activity against the BeyondTrust appliance
- Security scanning tools with curl/python user-agents performing routine health checks
- BeyondTrust automated upgrade processes that temporarily spawn system binaries
Other platforms for CVE-2026-1731
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-1731 PoC HTTP Request Simulation
Expected signal: IIS/nginx access log entry: POST /api/unauthenticated/session with user-agent 'CVE-2026-1731-PoC-Test' and POST body containing ';id;whoami;'. WAF should log or block the request.
- Test 2BeyondTrust Service Account Spawning Shell (Simulated Post-Exploitation)
Expected signal: Windows Security Event 4688: new process cmd.exe with parent process belonging to BeyondTrust service account (btrs_service). Process command line contains whoami, hostname, ipconfig, net user.
- Test 3BeyondTrust Process Outbound Reverse Shell Simulation
Expected signal: Linux auditd execve syscall: bash -i spawned by beyondtrust service process. Network connection record: beyondtrust process connecting outbound to LAB_ATTACKER_IP:4444 (non-standard port, external IP).
References (5)
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-1731 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month