CVE-2026-102764: Chinese APT Exploited BeyondTrust as Zero-Day — Detection, Hunting, and Remediation Guide

---
title: Suspicious Child Process Spawned by BeyondTrust Service Components
id: 3f8a2c91-7d44-4b1e-9a05-c6d2e8f1a734
status: experimental
description: Detects command shells, scripting engines, or system utilities spawned by BeyondTrust Remote Support / Privileged Remote Access service processes, consistent with post-exploitation tool deployment following exploitation of CVE-2026-102764.
references:
  - https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\bomgar'
      - '\beyondtrust'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - BeyondTrust support sessions legitimately launching shells on managed endpoints — scope to the BeyondTrust server/jump host itself rather than session targets
level: high
---
title: Security Log Clearing or Audit Policy Tampering
id: 8b1e4f27-2a93-4d5c-b761-9e0c3a5d82f6
status: experimental
description: Detects clearing of Windows event logs or disabling of audit policy, matching the anti-forensic log deletion behavior reported in the Armory Castle BeyondTrust campaign.
references:
  - https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
  - https://attack.mitre.org/techniques/T1070/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - ' clear-log '
  selection_auditpol:
    Image|endswith: '\auditpol.exe'
    CommandLine|contains:
      - '/clear'
      - '/disable'
  selection_ps:
    CommandLine|contains:
      - 'Clear-EventLog'
      - 'Remove-EventLog'
      - 'Limit-EventLog'
  condition: 1 of selection_*
falsepositives:
  - Rare; log clearing is almost never legitimate administrative activity on production servers
level: critical
---
title: Outbound Connection from BeyondTrust Service Process to External Host
id: c57d9a14-60e8-4f2b-a3c9-8d1b7e5f4028
status: experimental
description: Detects BeyondTrust service executables initiating outbound network connections to non-corporate destinations, potentially indicating C2 communication or data staging by custom tooling deployed after CVE-2026-102764 exploitation.
references:
  - https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\bomgar'
      - '\beyondtrust'
    Initiated: 'true'
  filter_vendor:
    DestinationHostname|endswith:
      - '.beyondtrust.com'
      - '.bomgar.com'
  condition: selection and not filter_vendor
falsepositives:
  - Legitimate BeyondTrust cloud portal connectivity — build an allowlist of known vendor endpoints and corporate destinations before enabling at high level
level: medium

// Hunt: BeyondTrust post-exploitation behavior (CVE-2026-102764 / Armory Castle)
// Part 1: BeyondTrust service processes spawning shells, scripting engines, or download utilities
let btProcesses = dynamic(["bomgar", "beyondtrust"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "net.exe", "nltest.exe", "whoami.exe"]);
let shellSpawns =
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any (btProcesses) or InitiatingProcessFolderPath has_any (btProcesses)
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId;
// Part 2: Log clearing / anti-forensics on the same estate
let logClearing =
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName =~ "wevtutil.exe" and ProcessCommandLine has_any (" cl ", "clear-log"))
   or (FileName =~ "auditpol.exe" and ProcessCommandLine has_any ("/clear", "/disable"))
   or ProcessCommandLine has_any ("Clear-EventLog", "Remove-EventLog")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName, ReportId;
// Correlate: flag any device appearing in both sets within the window
shellSpawns
| join kind=leftouter (logClearing | summarize LogClearEvents = count(), FirstClear = min(TimeGenerated) by DeviceName) on DeviceName
| extend LogClearingOnHost = iif(isnotempty(LogClearEvents), "YES - investigate as priority", "no")
| sort by TimeGenerated asc
;
// Run separately: show all log-clearing events regardless of BeyondTrust correlation
// logClearing | sort by TimeGenerated asc

-- Hunt: BeyondTrust post-exploitation (CVE-2026-102764)
-- Identify suspicious child processes of BeyondTrust service components
-- and execution of log-clearing utilities across the estate
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       pslist(Pid=Ppid).Exe AS ParentExe
FROM pslist()
WHERE (ParentExe =~ '(?i)bomgar|beyondtrust'
        AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin|curl|wget')
   OR CommandLine =~ '(?i)wevtutil.*(cl|clear-log)|auditpol.*(/clear|/disable)|Clear-EventLog|Remove-EventLog'

# CVE-2026-102764 - BeyondTrust compromise verification and hardening checks
# Run elevated on BeyondTrust servers and jump clients

# 1) Check for evidence of log clearing (Event 1102 = Security log cleared, 104 = System log cleared)
Write-Host "[+] Checking for log clearing events (last 90 days)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-90)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List
Get-WinEvent -FilterHashtable @{LogName='System'; Id=104; StartTime=(Get-Date).AddDays(-90)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List

# 2) Identify BeyondTrust services and their binary paths for version verification
Write-Host "[+] Enumerating BeyondTrust services..." -ForegroundColor Cyan
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match 'bomgar|beyondtrust' } |
  Select-Object Name, State, StartName, PathName | Format-List

# 3) Check whether Security log was truncated: earliest event timestamp vs. expected retention
Write-Host "[+] Checking earliest available Security log event (truncation indicator)..." -ForegroundColor Cyan
$oldest = Get-WinEvent -LogName Security -MaxEvents 1 -Oldest -ErrorAction SilentlyContinue
if ($oldest) { Write-Host "    Oldest Security event: $($oldest.TimeCreated)" }
else { Write-Host "    WARNING: Security log is empty or inaccessible - possible tampering" -ForegroundColor Red }

# 4) Confirm log forwarding is functioning (Sysmon/forwarder service present and running)
Write-Host "[+] Checking log forwarding / monitoring agents..." -ForegroundColor Cyan
Get-Service -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'sysmon|wef|nxlog|wazuh|crowdstrike|csagent|sense|mdedefender' } |
  Select-Object Name, Status, StartType | Format-Table

# 5) Audit recent executable drops in common staging locations
Write-Host "[+] Scanning staging directories for recently written executables..." -ForegroundColor Cyan
$paths = @("C:\ProgramData","C:\Windows\Temp","C:\Users\Public","$env:TEMP")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, LastWriteTime, Length
}

# 6) REMINDER: Patch action
Write-Host "`n[!] ACTION REQUIRED: Apply the BeyondTrust security update addressing CVE-2026-102764" -ForegroundColor Yellow
Write-Host "    Verify your Remote Support / Privileged Remote Access base version against the official" -ForegroundColor Yellow
Write-Host "    BeyondTrust security advisory. Do not rely on version display alone - confirm via vendor portal." -ForegroundColor Yellow

#!/bin/bash
# CVE-2026-102764 - appliance-side triage (run via vendor-approved shell access where permitted)
# 1) Look for gaps in local logs (unexpected truncation or missing date ranges)
echo "[+] Log file sizes and timestamps — look for anomalies or recent truncation"
ls -la /var/log/ | grep -E 'messages|secure|syslog|audit'
echo "[+] First vs last entries in auth/syslog — check for missing windows"
head -1 /var/log/syslog 2>/dev/null || head -1 /var/log/messages 2>/dev/null
# 2) Check for cleared shell histories
echo "[+] Shell history files — zero-length or recently replaced files are suspicious"
find /root /home -name ".bash_history" -exec ls -la {} \; 2>/dev/null
# 3) Recent binary drops in writable directories
echo "[+] Recently modified executables in /tmp, /var/tmp, /dev/shm"
find /tmp /var/tmp /dev/shm -type f -mtime -30 2>/dev/null | xargs ls -la 2>/dev/null
# 4) Verify syslog forwarding is alive
echo "[+] Syslog forwarding service status"
systemctl status rsyslog 2>/dev/null | head -5 || service syslog status 2>/dev/null