Bomgar Exploit - Scheduled Task Persistence via Bomgar

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Identifies the creation of a scheduled task using 'schtasks.exe' where the initiating process is a Bomgar executable (bomgar-rep.exe or bomgar-scc.exe). This behavior is indicative of an attacker establishing persistence after exploiting a Bomgar vulnerability.