BeyondTrust warned customers this week that a critical vulnerability in its Remote Support (RS) product has been actively exploited in attacks since late August — meaning threat actors had months of runway against unpatched systems before a fix became available. If your organization runs BeyondTrust RS for helpdesk remote sessions, vendor access, or third-party support, this is a treat-as-compromised situation, not a routine patch cycle.
This post breaks down what's at risk, how to hunt for exploitation in your environment, and the exact remediation steps to take today.
Why This Is a Five-Alarm Issue
Remote Support isn't a peripheral tool. It sits at the center of privileged access workflows:
- It's internet-facing by design. RS portals are exposed so external technicians and end users can initiate support sessions. That means the vulnerable component is directly reachable by unauthenticated attackers.
- It holds powerful credentials. RS deployments typically integrate with Active Directory, credential vaults, and service accounts with administrative reach into endpoints.
- It's a trusted remote access channel. An attacker who compromises the RS appliance inherits a legitimate, often unmonitored path into managed endpoints — bypassing EDR telemetry that would flag unauthorized RMM tools.
- Exploitation began in late August. That is a long dwell window. Any organization that was unpatched during that period must assume the appliance was probed — and possibly breached — and hunt accordingly.
A compromised remote support platform is functionally equivalent to handing an attacker a signed, sanctioned remote administration toolkit inside your environment. Treat this accordingly.
Technical Analysis
Affected Product
- Product: BeyondTrust Remote Support (RS)
- Deployment models: On-premises appliances and customer-hosted instances are the primary concern. BeyondTrust-managed cloud customers should verify with the vendor whether remediation was applied automatically, and demand written confirmation of the patched build date.
Exploitation Status
- Confirmed in-the-wild exploitation since late August, per the vendor's advisory.
- Given active exploitation, expect this vulnerability to land in the CISA Known Exploited Vulnerabilities (KEV) catalog if it hasn't already — monitor the KEV feed and apply the associated federal remediation deadline as your internal SLA even if you're not bound by BOD 22-01.
Defender's View of the Attack Chain
While full technical details remain limited, exploitation of remote support/access platforms follows a well-documented pattern that shapes how we hunt:
- External reconnaissance — attackers enumerate internet-facing RS portals (predictable hostnames like
support.,remote.,helpdesk.subdomains; Shodan/Censys fingerprinting of the BeyondTrust web interface). - Unauthenticated exploitation of the vulnerable RS component, yielding code execution in the context of the RS application service.
- Post-exploitation — webshell or script dropped into the web root, command execution spawning from the RS service process, credential theft from the appliance, and creation of rogue local/service accounts for persistence.
- Pivot — abuse of RS's stored credentials and session capabilities to push commands or agents to managed endpoints, or harvest session recordings and vaulted secrets.
The observable artifacts defenders should key on: the RS web/service process spawning shells or scripting interpreters, unexpected files written to web-accessible directories, and outbound connections from the appliance that don't match baseline behavior.
Detection & Response
This is a technical threat with confirmed exploitation — hunting is mandatory, not optional. The detections below are technique-derived and should be tuned against your baseline RS process names and installation paths.
Sigma Rules
The following rules target post-exploitation behavior on and around the BeyondTrust RS host. Deploy them and back-search your logs to August 1 of last year — not just the date of the advisory.
---
title: BeyondTrust RS Service Spawning Shell or Scripting Interpreter
id: 3f8a1b42-7c9d-4e5a-b6f1-2a3c4d5e6f70
status: experimental
description: Detects the BeyondTrust Remote Support web/service process spawning command shells, PowerShell, or scripting interpreters — a strong post-exploitation indicator for web application RCE on the RS appliance host.
references:
- https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- 'beyondtrust'
- 'bomgar'
- 'remotesupport'
- 'httpd'
- 'nginx'
- 'java.exe'
- 'w3wp.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\whoami.exe'
- '\net.exe'
- '\net1.exe'
- '\nltest.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate BeyondTrust upgrade or diagnostics routines — whitelist known parent/child pairs after validation
level: high
---
title: Webshell or Script Dropped in Web-Accessible Directories
id: 9b2c4d61-8e3f-4a5b-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects creation of script or executable files in web server and application directories, consistent with webshell deployment following exploitation of an internet-facing support portal.
references:
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\inetpub\wwwroot\'
- '\htdocs\'
- '\www\'
- '\webapps\'
- '\tomcat\'
- 'beyondtrust'
- 'bomgar'
selection_ext:
TargetFilename|endswith:
- '.aspx'
- '.ashx'
- '.asp'
- '.jsp'
- '.jspx'
- '.php'
- '.war'
- '.dll'
- '.exe'
condition: selection_path and selection_ext
falsepositives:
- Vendor updates and legitimate application deployments — correlate with patch windows and change tickets
level: high
---
title: Local Account Creation on Remote Support Appliance Host
id: 5e7f2a18-3b4c-4d5e-8f9a-6b7c8d9e0f1a
status: experimental
description: Detects creation of new local user accounts on hosts running remote support infrastructure, a common persistence step after appliance compromise.
references:
- https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1136.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'net user'
- 'net localgroup administrators'
- 'New-LocalUser'
- 'Add-LocalGroupMember'
- 'net.exe /add'
filter:
CommandLine|contains:
- '/delete'
condition: selection and not filter
falsepositives:
- Provisioning scripts and administrative maintenance — scope to RS appliance hosts for highest fidelity
level: medium
KQL Hunting — Microsoft Sentinel / Defender
This query hunts for the RS host's web/service processes spawning command interpreters, plus outbound connections from the appliance to rare destinations. Back-search to the start of the exploitation window (late August).
// Hunt 1: BeyondTrust RS processes spawning shells or LOLBins
let LookbackStart = datetime(2025-08-01);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "nltest.exe", "curl.exe", "wget.exe"]);
DeviceProcessEvents
| where TimeGenerated >= LookbackStart
| where InitiatingProcessFileName has_any ("beyondtrust", "bomgar", "httpd", "nginx", "java", "w3wp", "tomcat")
or InitiatingProcessFolderPath has_any ("beyondtrust", "bomgar", "remotesupport")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by TimeGenerated asc;
// Hunt 2: Outbound connections from RS appliance hosts to rare external destinations
let LookbackStart = datetime(2025-08-01);
DeviceNetworkEvents
| where TimeGenerated >= LookbackStart
| where DeviceName has_any ("bomgar", "beyondtrust", "rs-app", "support-appliance") // tune to your RS hostname pattern
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| where ConnectionCount < 50 // surface rare destinations; tune threshold to baseline
| order by FirstSeen asc;
// Hunt 3: Syslog-ingested Linux appliances — shell spawned by web service users
Syslog
| where TimeGenerated >= datetime(2025-08-01)
| where SyslogMessage has_any ("beyondtrust", "bomgar")
or Computer has_any ("bomgar", "beyondtrust")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "useradd", "curl ", "wget ", "chmod +x", "base64")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated asc;
Velociraptor VQL — Endpoint Forensics on the RS Host
Run this hunt across the RS appliance host (or any Windows jump/management servers in the support path) to surface suspicious processes, webshell-like files, and unexpected network listeners.
-- Artifact: BeyondTrust_RS_PostExploitation_Hunt
-- Purpose: Surface post-exploitation artifacts on/near the BeyondTrust RS host
-- 1. Suspicious processes spawned from web/app service contexts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|whoami)'
AND Username =~ '(?i)(SYSTEM|NETWORK SERVICE|IIS|LOCAL SERVICE)')
OR CommandLine =~ '(?i)(base64|downloadstring|invoke-expression|iex|curl |wget )'
-- 2. Script/executable files in web-accessible directories modified since exploitation window
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx', 'C:/inetpub/wwwroot/**/*.ashx',
'C:/Program Files*/**/*.jsp', 'C:/**/webapps/**/*.jsp',
'C:/**/htdocs/**/*.php'])
WHERE Mtime > '2025-08-01'
ORDER BY Mtime ASC
-- 3. Active network listeners and connections for unexpected exposure
SELECT Pid, Name, Path, Family, Type, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'LISTEN|ESTAB'
AND NOT Raddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.0\.0\.0$|\[?::1)'
Remediation
Execute in this order. Do not patch and move on — the exploitation window is long enough that patching without hunting is negligence.
1. Patch Immediately
- Apply the vendor-supplied fix for BeyondTrust Remote Support per the official advisory at https://www.beyondtrust.com/trust-center/security-advisories (select the Remote Support advisory). Confirm the exact patched build number in writing from BeyondTrust support — do not assume auto-update covered your deployment model.
- Cloud-hosted customers: obtain written confirmation of when your instance was remediated and whether BeyondTrust's telemetry shows any anomalous activity on your instance during the exposure window.
- Monitor the CISA KEV catalog for this vulnerability's entry and adopt its due date as your internal deadline (KEV deadlines for federal agencies are a reliable proxy for real-world risk).
2. Hunt Before You Trust
- Run the detections above against telemetry going back to August 1, 2025 — the beginning of the known exploitation window.
- Review RS administrative logs: new representative accounts created, configuration changes, unusual session initiations, and API activity outside normal support hours.
- Audit every account with RS console access; force password resets and verify MFA enrollment for all representative accounts.
3. Rotate Everything the Appliance Could Touch
If you cannot conclusively prove the appliance was uncompromised during the exposure window:
- Rotate all credentials stored in or accessible through RS — vaulted service accounts, AD-integrated credentials, API keys, and session injection credentials.
- Rotate local administrator credentials on endpoints that received RS sessions during the window (LAPS expiration is your friend here).
- Invalidate active sessions and API tokens.
4. Reduce Exposure Permanently
- Take RS off the open internet. Place the portal behind a VPN gateway, ZTNA broker, or IP allowlist for known support sources. There is no good reason an RCE-vulnerable support portal should be anonymously reachable.
- Enforce MFA on all RS console access and disable unused representative accounts.
- Segment the appliance: the RS host should not have unrestricted outbound internet access or flat-network reach into domain controllers and Tier-0 assets.
- Forward RS application and host logs to your SIEM if you aren't already — support platforms are chronically under-monitored relative to their privilege level.
5. Verification Script
Use the following to confirm patch state, enumerate suspicious local accounts, and surface recent service/process anomalies on a Windows-based RS management host:
# BeyondTrust RS post-advisory verification — run elevated on the RS host
# 1. Confirm installed BeyondTrust components and versions
Get-WmiObject -Class Win32_Product -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match 'BeyondTrust|Bomgar' } |
Select-Object Name, Version, InstallDate | Format-Table -AutoSize
# 2. Enumerate local accounts created since exploitation window opened
$WindowStart = Get-Date '2025-08-01'
Get-LocalUser | Where-Object { $_.Enabled -eq $true } |
Select-Object Name, Enabled, LastLogon, PasswordLastSet | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=$WindowStart} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Message | Format-List
# 3. Flag services and scheduled tasks created during the exposure window
Get-CimInstance Win32_Service |
Where-Object { $_.PathName -match 'temp|appdata|programdata' } |
Select-Object Name, DisplayName, PathName, StartMode, State | Format-List
Get-ScheduledTask | Where-Object { $_.Date -gt $WindowStart } |
Select-Object TaskName, TaskPath, Date, State | Format-Table -AutoSize
# 4. Pull recent outbound connections from RS-related processes
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.|192\.168\.|127\.|0\.0\.0\.0)' } |
ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{
Process = $proc.ProcessName; Path = $proc.Path
RemoteIP = $_.RemoteAddress; RemotePort = $_.RemotePort
}
} | Format-Table -AutoSize
Review the output against your change-management records. Anything created between August and your patch date that you can't attribute to a ticket deserves forensic scrutiny.
Bottom Line
Remote access and privilege management platforms are force multipliers — for you and for anyone who compromises them. BeyondTrust RS being exploited for months before a public advisory means your exposure window is measured in quarters, not days. Patch today, hunt back to August, rotate credentials the appliance could reach, and get the portal off the public internet. If your team lacks the telemetry depth or IR capacity to run that compromise assessment confidently, that gap itself is the finding.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.