Bomgar Exploit - Interactive Reverse Shell Execution
Detects the Bomgar process piping the output of a command shell directly into a network socket, establishing an interactive reverse shell. This often indicates exploitation of a Bomgar vulnerability.
Microsoft Sentinel (KQL)

