CVE-2026-102764: BeyondTrust Remote Support Unauthenticated File Upload to RCE — Detection and Remediation Guide

---
title: BeyondTrust Remote Support Webshell Creation via CVE-2026-102764
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects creation of script files in BeyondTrust Remote Support web server directories, consistent with webshell deployment after exploitation of CVE-2026-102764.
references:
  - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|startswith:
      - '/var/www/html/'
      - '/usr/local/beyondtrust/htdocs/'
      - '/opt/beyondtrust/webroot/'
  selection_extensions:
    TargetFilename|endswith:
      - '.php'
      - '.py'
      - '.jsp'
      - '.sh'
      - '.cgi'
  condition: selection_paths and selection_extensions
falsepositives:
  - Legitimate software updates or administrative uploads by BeyondTrust support
level: high
---
title: Suspicious Process Spawned by BeyondTrust Site User
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects unexpected process execution under the BeyondTrust site OS user context, which may indicate post-exploitation activity following CVE-2026-102764 compromise.
references:
  - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User|contains:
      - 'site'
      - 'beyondtrust'
  selection_images:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/netcat'
  filter_legitimate:
    CommandLine|contains:
      - '/opt/beyondtrust/'
      - 'support_session'
      - 'health_check'
  condition: selection_user and selection_images and not filter_legitimate
falsepositives:
  - Rare administrative troubleshooting by BeyondTrust support engineers
level: high
---
title: Network Connection from BeyondTrust Appliance to External IP
id: 9c8e2f45-1a7d-4b89-9c3e-5f7a2b1d4e6f
status: experimental
description: Detects outbound network connections from the BeyondTrust Remote Support appliance to non-RFC1918 destinations, excluding vendor update servers. May indicate C2 traffic after compromise.
references:
  - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|startswith:
      - '/opt/beyondtrust/'
      - '/usr/local/beyondtrust/'
  selection_destination:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_beyondtrust:
    DestinationHostname|contains:
      - 'beyondtrust.com'
      - 'beyondtrustcloud.com'
  condition: selection_process and not selection_destination and not filter_beyondtrust
falsepositives:
  - Licensing checks or telemetry if vendor domains are misconfigured
level: medium

// Hunt for BeyondTrust Remote Support post-exploitation indicators
// CVE-2026-102764 — File write and suspicious process execution

let timeframe = 7d;

// File creation in web server or cron directories
Syslog
| where TimeGenerated > ago(timeframe)
| where Computer contains "beyondtrust" or Computer contains "bt-rs"
| where SyslogMessage has_any ("File created", "File modified")
| extend FilePath = extract(@"FilePath=([^\s]+)", 1, SyslogMessage)
| where FilePath has_any ("/var/www/html/", "/opt/beyondtrust/webroot/", "/etc/cron.d/", "/etc/cron.hourly/")
| where FilePath endswith ".php" or FilePath endswith ".py" or FilePath endswith ".sh"
| project TimeGenerated, Computer, FilePath, SyslogMessage
| join kind=leftouter (
    // Process execution by site user
    Syslog
    | where TimeGenerated > ago(timeframe)
    | where Computer contains "beyondtrust" or Computer contains "bt-rs"
    | where SyslogMessage has "site" and SyslogMessage has_any ("bash", "sh", "python", "curl", "wget")
    | extend CommandLine = extract(@"CommandLine=([^\s]+)", 1, SyslogMessage)
    | project ProcessTime=TimeGenerated, Computer, CommandLine
) on Computer
| extend TimeDelta = abs(ProcessTime - TimeGenerated)
| where TimeDelta < 5m or isempty(ProcessTime)
| summarize arg_min(TimeGenerated, *) by FilePath, Computer
| project TimeGenerated, Computer, FilePath, CommandLine, SyslogMessage
| order by TimeGenerated desc

// Alternative: Network connections to external IPs from appliance
union isfuzzy=true (
    CommonSecurityLog
    | where TimeGenerated > ago(timeframe)
    | where DeviceProduct contains "BeyondTrust"
    | where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
    | where DestinationHostName !contains "beyondtrust.com"
    | project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DeviceAction
),
(
    Syslog
    | where TimeGenerated > ago(timeframe)
    | where Computer contains "beyondtrust" or Computer contains "bt-rs"
    | where SyslogMessage has "connect" and SyslogMessage has "refused" == false
    | extend DestIP = extract(@"dst=([0-9\.]+)", 1, SyslogMessage)
    | where DestIP !startswith "10." and DestIP !startswith "192.168." and DestIP !startswith "172.16."
    | project TimeGenerated, Computer, DestIP, SyslogMessage
)
)
| summarize count() by DestinationIP, DestinationHostName, DestIP
| where count_ > 10
| order by count_ desc

-- BeyondTrust CVE-2026-102764 Post-Exploitation Hunt
-- Detects webshells, suspicious processes, and persistence mechanisms

LET webshell_paths = '/var/www/html/**/*.php,/var/www/html/**/*.py,/opt/beyondtrust/webroot/**/*.sh,/etc/cron.d/*'

LET suspicious_procs = 'bash,sh,python,python3,perl,curl,wget,nc,netcat'

// Hunt for recently created script files in web and cron directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    Mode,
    Uid,
    Gid
FROM glob(globs=webshell_paths)
WHERE Mtime > now() - 604800  -- Last 7 days

// Hunt for suspicious processes running as site user
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Username =~ 'site|beyondtrust'
  AND Name =~ suspicious_procs
  AND CommandLine !~ '/opt/beyondtrust/'
  AND CommandLine !~ 'health_check'
  AND CreateTime > now() - 604800

// Hunt for outbound network connections from BeyondTrust processes
SELECT 
    Pid,
    Name,
    CommandLine,
    LocalAddress,
    RemoteAddress,
    State
FROM netstat()
WHERE Name =~ 'brain|thin-scc|beyondtrust'
  AND RemoteAddress !~ '^10\\.|^192\\.168\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.'
  AND RemoteAddress !~ 'beyondtrust.com'
  AND State = 'ESTABLISHED'

#!/bin/bash
# CVE-2026-102764 Verification and Hardening Script
# Security Arsenal — February 2026

set -euo pipefail

echo "=== BeyondTrust Remote Support CVE-2026-102764 Verification ==="
echo "Timestamp: $(date -u)"
echo ""

# 1. Check appliance version
if [[ -f /opt/beyondtrust/version ]]; then
    VERSION=$(cat /opt/beyondtrust/version)
    echo "[+] Detected BeyondTrust version: $VERSION"
    
    # Parse version
    MAJOR=$(echo $VERSION | cut -d. -f1)
    MINOR=$(echo $VERSION | cut -d. -f2)
    PATCH=$(echo $VERSION | cut -d. -f3)
    
    if [[ $MAJOR -lt 24 ]] || [[ $MAJOR -eq 24 && $MINOR -lt 4 ]]; then
        echo "[!] VULNERABLE: Version $VERSION is affected by CVE-2026-102764"
        echo "    Required: 24.4.0 or later"
    else
        echo "[OK] Version $VERSION is patched (24.4.0+)"
    fi
else
    echo "[!] Could not determine version. Check /opt/beyondtrust/version"
fi

# 2. Check for suspicious files in web directories
echo ""
echo "=== Checking for suspicious files ==="
WEB_DIRS=("/var/www/html" "/usr/local/beyondtrust/htdocs" "/opt/beyondtrust/webroot")
SUSPICIOUS_EXT=("php" "py" "jsp" "sh" "cgi")

for dir in "${WEB_DIRS[@]}"; do
    if [[ -d "$dir" ]]; then
        echo "[+] Scanning $dir"
        find "$dir" -type f \( -name "*.php" -o -name "*.py" -o -name "*.sh" -o -name "*.jsp" \) \
            -mtime -7 -ls 2>/dev/null | while read -r line; do
            echo "[!] Recent script file: $line"
        done
    fi
done

# 3. Check for suspicious processes
echo ""
echo "=== Checking for suspicious processes ==="
ps aux | grep -E "^(site|beyondtrust)" | grep -E "(bash|sh|python|perl|curl|wget|nc)" | while read -r proc; do
    echo "[!] Suspicious process: $proc"
done

# 4. Check cron directories
echo ""
echo "=== Checking cron persistence ==="
for cron_dir in /etc/cron.d /etc/cron.hourly /var/spool/cron; do
    if [[ -d "$cron_dir" ]]; then
        find "$cron_dir" -type f -mtime -7 -ls 2>/dev/null | while read -r line; do
            echo "[!] Recent cron file: $line"
        done
    fi
done

# 5. Temporary mitigation: Block external access to customer connection endpoint
echo ""
echo "=== Applying temporary mitigation ==="
echo "[!] Blocking external access to customer connection endpoint (TCP/443)"
echo "    This will break inbound support sessions until reverted"

# Check if iptables is available
if command -v iptables &> /dev/null; then
    # Allow localhost and RFC1918
    iptables -A INPUT -s 127.0.0.1 -p tcp --dport 443 -j ACCEPT
    iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 443 -j ACCEPT
    iptables -A INPUT -s 172.16.0.0/12 -p tcp --dport 443 -j ACCEPT
    iptables -A INPUT -s 192.168.0.0/16 -p tcp --dport 443 -j ACCEPT
    # Block all other 443
    iptables -A INPUT -p tcp --dport 443 -j DROP
    echo "[OK] iptables rules applied. To revert: iptables -F"
else
    echo "[!] iptables not available. Use appliance firewall or network ACLs"
fi

echo ""
echo "=== Verification complete ==="
echo "Next steps:"
echo "  1. If version is vulnerable, schedule emergency patching to 24.4.0+"
echo "  2. Review any suspicious files or processes identified above"
echo "  3. Check authentication logs for unexpected session activity"
echo "  4. Contact BeyondTrust support if compromise is suspected"