BeyondTrust/Bomgar Remote Support Spawning Post-Exploitation Tooling
Detects the execution of high-risk discovery or collection tools, such as vssadmin.exe, ntdsutil.exe, wevtutil.exe, certutil.exe, adfind.exe, dsquery.exe, klist.exe, or nltest.exe, when spawned by a BeyondTrust/Bomgar Remote Support session process (bomgar-scc.exe). This activity is indicative of post-exploitation behavior, potentially linked to intrusions described in CVE-2026-1731.
Sigma
