BeyondTrust Suspicious Process Lineage

Ethan Andrews@eandrews

•updated Feb 16, 2026•12•0•107

Detects a BeyondTrust (Bomgar) process spawning shell or system administration child processes. This activity is highly indicative of OS command injection, potentially related to the exploitation of CVE-2026-1731.