BeyondTrust Remote Support Client Post-Exploitation Activity

Ethan Andrews@eandrews

•updated May 7, 2026•10•0•311

This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.